CVE-2026-74557

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsiscsicmdrsp copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes,...

CVE-2026-74558

In the Linux kernel, the following vulnerability has been resolved: xsk: reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past...

CVE-2026-74562

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6ilist walks in replace check and notify fib6checknhlist and nexthopreplacenotify walk nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTMNEWROUTE/RTMDELROUTE run...

CVE-2026-74563

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

CVE-2026-74561

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush walks nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list under nh-loc...

CVE-2026-74568

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...

CVE-2026-74548

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrxstats in nvremove nvremove frees the per-CPU txrxstats before unregisternetdev. Until unregister completes, ndogetstats64, the NAPI/xmit data path, and nvclose/drain may still access txrxstats, leading t...

UBUNTU-CVE-2026-74568

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...

UBUNTU-CVE-2026-74560

In the Linux kernel, the following vulnerability has been resolved: xsk: fix buffer leak in xskdropskb for AFXDP multi-buffer Tx This patch is inspired by the check1 from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the whole...

UBUNTU-CVE-2026-74571

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts BUG Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address:...

UBUNTU-CVE-2026-74561

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush walks nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list under nh-loc...

UBUNTU-CVE-2026-74572

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock between metadata writeback and transaction commit When writing out metadata extent buffers in a zoned filesystem, btreewritepages holds fsinfo-zonedmetaiolock across the whole writeback loop, including...

UBUNTU-CVE-2026-74575

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

UBUNTU-CVE-2026-74567

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyringgetkeychunk For description-level chunks keyringgetkeychunk advances the read pointer by level sizeoflong past the inline prefix but only bounds-checks the prefix, so a long enough key...

UBUNTU-CVE-2026-74556

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Bound SCSI Response data segment to the connection buffer iscsitcphdrdissect receives the data segment of several PDU types into the fixed-size conn-data buffer, which is allocated for ISCSIDEFMAXRECVSEGLEN 819...

UBUNTU-CVE-2026-74551

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg which maps this buffer directly for DMA. When the DMA mapping flushes or...

UBUNTU-CVE-2026-74553

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775-core Fix number of temperature registers for NCT6116 Unlike NCT6106, NCT6116 only has three temperature registers, and with it only three temperature source and temperature source configuration registers. The...

UBUNTU-CVE-2026-74574

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxdcdevopen The faileddevadd and faileddevname paths drop the file-device reference while wq-wqlock is still held. If putdevicefdev drops the last reference, idxdfiledevrelease...

CVE-2026-74550

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inetgetpeerv4 or inetgetpeerv6 fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending...

CVE-2026-74553

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775-core Fix number of temperature registers for NCT6116 Unlike NCT6106, NCT6116 only has three temperature registers, and with it only three temperature source and temperature source configuration registers. The...