CVE-2026-98961

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a...

UBUNTU-CVE-2026-99060

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

CVE-2026-98989

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

UBUNTU-CVE-2026-99062

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CVE-2026-98973

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked listdel in drmbridgeadd When re-adding a bridge that was previously removed, drmbridgeadd drops it from bridgelingeringlist without holding bridgelock. Both bridgelist and bridgelingeringlist are protecte...

CVE-2026-98929

In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsgifinfobuildskb when IPv4 forwarding is enabled by default...

CVE-2026-99003

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

CVE-2026-99045

In the Linux kernel, the following vulnerability has been resolved: ibmveth: hfree logical LAN on open-fail after register ibmvethopen registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to outfreebufferpools without hfreelogicallan, so PHYP still owns the...

UBUNTU-CVE-2026-98987

In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attachrecursivemnt preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on top o...

CVE-2026-99004

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

UBUNTU-CVE-2026-98930

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When injectsigpstop is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread...

CVE-2026-99017

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCVALTERNATIVEEARLY for THEAD GHOSTWRITE errataprobeghostwrite only marks the CPU as vulnerable when it is called at the RISCVALTERNATIVESEARLYBOOT stage, and the mitigation in ghostwriteenablemitigation...

CVE-2026-99084

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-99085

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in schedcpuwaitempty until nothing else is left, and the only thing that wakes it...

CVE-2026-98995

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

UBUNTU-CVE-2026-99065

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

CVE-2026-98958

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...

CVE-2026-99026

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bctransmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but teamxmit still returns NETDEVTXOK...

UBUNTU-CVE-2026-98998

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

CVE-2026-98918

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damonptepmkold damonvaprepareaccesscheck picks a random byte address within the region and stores it in r-samplingaddr. damonvamkold passes it into a page table walk, which hands...