UBUNTU-CVE-2026-89590

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

UBUNTU-CVE-2026-89454

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix IRQ domain leaks in the error paths of pldainitinterrupts pldainitinterrupts initializes IRQ domains and creates IRQ mapping but does not unwind them when later step fails. If platformgetirq or either...

CVE-2026-89544

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

DEBIAN-CVE-2026-80949

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmfsdioreadcontrol The memory allocated for buf is not freed in some of the error paths in brcmfsdioreadcontrol. Fix that by adding vfree calls. arend: rework as suggested by Johannes...

CVE-2026-81004

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed...

CVE-2026-89454

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix IRQ domain leaks in the error paths of pldainitinterrupts pldainitinterrupts initializes IRQ domains and creates IRQ mapping but does not unwind them when later step fails. If platformgetirq or either...

CVE-2026-89590

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89522

In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isysregisterdevices registers the V4L2 async notifier via isysnotifierinit. If a subsequent probe step such as isysfwloginit fails, isysprobe jumps to the outcleanup...

CVE-2026-80948

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart In iwlopmodedvmstart, jumping to outfreeeeprom currently bypasses the outfreeeepromblob label. Consequently, error paths triggered after successfully parsing the EEPROM fre...

UBUNTU-CVE-2026-89577

In the Linux kernel, the following vulnerability has been resolved: dm-io: report non-retryable errors separatedly The error codes BLKSTSNOTSUPP and BLKSTSINVAL should not cause leg failure on dm-raid1. This patch changes the interface to dm-io, so that it reports two error bitmaps - errorbits an...

CVE-2026-81016

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amdstbs2dinit discards the return value of several S2D SMU commands. When the SMU refuses a command e.g. "SMU cmd failed. err: 0xff" the failure is only noticed...

CVE-2026-80996

In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...

CVE-2026-80949

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmfsdioreadcontrol The memory allocated for buf is not freed in some of the error paths in brcmfsdioreadcontrol. Fix that by adding vfree calls. arend: rework as suggested by Johannes...

CVE-2026-89582

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

UBUNTU-CVE-2026-89522

In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isysregisterdevices registers the V4L2 async notifier via isysnotifierinit. If a subsequent probe step such as isysfwloginit fails, isysprobe jumps to the outcleanup...

CVE-2026-89674

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

CVE-2026-89458

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Do not complete a failed ESE read as successful dasdinthandler completes an NRF read of an unallocated ESE track by calling eseread and unconditionally marking the request DASDCQRSUCCESS. dasdeckdeseread can return an...

AZL-100217 CVE-2026-80949 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmfsdioreadcontrol The memory allocated for buf is not freed in some of the error paths in brcmfsdioreadcontrol. Fix that by adding vfree calls. arend: rework as suggested by Johannes...

CVE-2026-89462

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040getvcell and max17040getsoc ignore errors returned by regmapread. When an I2C transfer fails, the uninitialized register value is converted and reported to userspace...

UBUNTU-CVE-2026-89462

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040getvcell and max17040getsoc ignore errors returned by regmapread. When an I2C transfer fails, the uninitialized register value is converted and reported to userspace...