UBUNTU-CVE-2026-63855

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v2.5 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

UBUNTU-CVE-2026-63972

In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When manaperportqueueresetworkhandler runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc-txqp and apc-rxqs already...

UBUNTU-CVE-2026-63931

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: fix division by zero in writeraw Add a zero check for val2 before using it as a divisor when setting the sampling frequency. A user writing a zero fractional part to the samplingfrequency sysfs attribute...

UBUNTU-CVE-2026-63854

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v3.0 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

UBUNTU-CVE-2026-64151

In the Linux kernel, the following vulnerability has been resolved: iommupt: Check for missing PAGESIZE in the pgsizebitmap Sashiko pointed out that the driver could drop PAGESIZE from the pgsizebitmap. That is technically allowed but nothing does it, and such an iommudomain would not be used wit...

UBUNTU-CVE-2026-64026

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

UBUNTU-CVE-2026-63862

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtkpciesetupirq, the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without...

UBUNTU-CVE-2026-64080

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notifylock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister...

UBUNTU-CVE-2026-64107

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512xoverclockxxxput In the pcm512x chipset driver, pcm512xoverclockxxxput is defined as a general mixer kcontrol instead of a DAPM kcontrol, so struct sndsocdapmcontext must n...

UBUNTU-CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

UBUNTU-CVE-2026-64160

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in -remoteisize and -zeropoint Fix potential tearing in using -remoteisize and -zeropoint by copying isizeread and isizewrite and using the same seqcount as for isize. We need to make sure that...

UBUNTU-CVE-2026-64157

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix partial invalidation of streaming-write folio In netfsinvalidatefolio, if the region of a partial invalidation overlaps the front but not all of a dirty write cached in a streaming write page dirty, but not uptodate,...

UBUNTU-CVE-2026-64019

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing...

UBUNTU-CVE-2026-64173

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed to allocate objects, the map-ops-eltalloc call was never successful. In this case, map-ops-eltfree should not be called...

UBUNTU-CVE-2026-63844

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v4.0.3 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 2f6afc97d259d530f4f86c7743efbc573a8da927...

UBUNTU-CVE-2026-64066

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsreadtopagecache to pause on subreq failure Fix netfsreadtopagecache so that it pauses the generation of new subrequests if an already-issued subrequest fails...

UBUNTU-CVE-2026-64002

In the Linux kernel, the following vulnerability has been resolved: ipv4: free net-ipv4.sysctllocalreservedports after unregisternetsysctltable ipv4sysctlexitnet is currently freeing net-ipv4.sysctllocalreservedports too soon. Only after unregisternetsysctltable we can be sure no threads can...

UBUNTU-CVE-2026-63908

In the Linux kernel, the following vulnerability has been resolved: Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known mxtobjsizeobject, the driver intends to discard the extra bytes. The loop iterate...

UBUNTU-CVE-2026-64031

In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: Thread 1 Thread 2 zerofsfillbiovec ... filemapaddfolio 1 zerofsbindcache...

UBUNTU-CVE-2026-63892

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...