CVE-2026-99009

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

UBUNTU-CVE-2026-99009

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

UBUNTU-CVE-2026-98981

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...

CVE-2026-99077

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

UBUNTU-CVE-2026-99077

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

UBUNTU-CVE-2026-99083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-99081

In the Linux kernel, the following vulnerability has been resolved: bnxten: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: DMA Read NOPASID Request...

UBUNTU-CVE-2026-99081

In the Linux kernel, the following vulnerability has been resolved: bnxten: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: DMA Read NOPASID Request...

CVE-2026-99059

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

UBUNTU-CVE-2026-99056

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

CVE-2026-99024

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized opteeprobe called teedeviceregister on both the client and the supplicant device before the rest of struct optee had been initialized. teedeviceregister calls cdevdeviceadd,...

UBUNTU-CVE-2026-98977

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

CVE-2026-98979

In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount...

CVE-2026-98933

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

UBUNTU-CVE-2026-98933

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

CVE-2026-99025

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovsflowcmddump calls ovsflowstatsget for eve...

CVE-2026-99019

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices chreadconfig looks up the scsidevice of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch-dt...

UBUNTU-CVE-2026-99024

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized opteeprobe called teedeviceregister on both the client and the supplicant device before the rest of struct optee had been initialized. teedeviceregister calls cdevdeviceadd,...

CVE-2026-99010

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

CVE-2026-98981

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...