CVE-2026-99068

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...

UBUNTU-CVE-2026-99075

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

UBUNTU-CVE-2026-99068

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...

UBUNTU-CVE-2026-98951

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin userregsetcopyin only copies count bytes, so a PTRACESETREGSET request with a short iovlen leaves the rest of the stack buffer uninitialized. In riscvvrset that garbage ...

UBUNTU-CVE-2026-98980

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. stepinto stepinto rechecks dseq and followmountrcu rechecks mountlock. An entry that gets unlinked in between causes the...

UBUNTU-CVE-2026-98923

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremapprot Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremapprot through genericaccessphys: WARNING:...

UBUNTU-CVE-2026-99011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

UBUNTU-CVE-2026-98982

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount dallocpseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree frees them right aw...

UBUNTU-CVE-2026-99073

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...

UBUNTU-CVE-2026-99030

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

CVE-2026-98983

In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switchtasknamespaces and copynamespaces and dropped...

UBUNTU-CVE-2026-98948

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumflower: Fix port range register leak in tmpltcreate mlxswspflowertmpltcreate parses a flowclsoffload template into a stack-local struct mlxswspaclruleinfo purely to compute rulei.values.elusage. Parsing can acquire...

UBUNTU-CVE-2026-99065

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

UBUNTU-CVE-2026-99028

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

UBUNTU-CVE-2026-98975

In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes every mapping moved and hands the reflink flag over to the other file...

CVE-2026-98928

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUESTHASSVE from the SVE feature bit at EL2 pkvminitfeaturesfromhost takes KVMARCHFLAGGUESTHASSVE and KVMARMVCPUSVE from the host separately, but pkvmvcpuinitsve tests the bit while vcpuhassve reads the flag. A...

CVE-2026-98936

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not g...

CVE-2026-99022

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

UBUNTU-CVE-2026-99022

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

UBUNTU-CVE-2026-98934

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...