UBUNTU-CVE-2026-72181

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIGCPUMASKOFFSTACK is enabled, cpumaskvart is a pointer. Consequently, sizeofnewmask evaluates to the pointer size...

CVE-2026-72181

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIGCPUMASKOFFSTACK is enabled, cpumaskvart is a pointer. Consequently, sizeofnewmask evaluates to the pointer size...

EUVD-2026-58939

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIGCPUMASKOFFSTACK is enabled, cpumaskvart is a pointer. Consequently, sizeofnewmask evaluates to the pointer size...

CVE-2026-72181

Linux kernel vulnerability CVE-2026-72181 (mips: sched: Fix CPUMASK_OFFSTACK memory corruption) fixes a memory-management flaw when CONFIG_CPUMASK_OFFSTACK is enabled: cpumask_var_t is a pointer, so sizeof(new_mask) equals pointer size and copy_from_user() can clobber the mask pointer; the old pa...

CVE-2026-72181 mips: sched: Fix CPUMASK_OFFSTACK memory corruption

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIGCPUMASKOFFSTACK is enabled, cpumaskvart is a pointer. Consequently, sizeofnewmask evaluates to the pointer size...

CVE-2026-72181 mips: sched: Fix CPUMASK_OFFSTACK memory corruption

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIGCPUMASKOFFSTACK is enabled, cpumaskvart is a pointer. Consequently, sizeofnewmask evaluates to the pointer size...

PT-2026-72369

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASK OFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIG CPUMASK OFFSTACK is enabled, cpumask var t is a pointer. Consequently, sizeofnew mask evaluates to the pointe...

The vulnerability of the Linux operating system’s kernel, related to copying buffers without checking the input data, allows a hacker to trigger a service failure.

The vulnerability of the Linux operating system’s kernel is related to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

DEBIAN-CVE-2026-68435

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexecload2 path filemode == 0 passes the user-space segment buffer straight to strncmp...

CVE-2026-68435

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexecload2 path filemode == 0 passes the user-space segment buffer straight to strncmp...

CVE-2026-68435

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexecload2 path filemode == 0 passes the user-space segment buffer straight to strncmp...

CVE-2026-68435 LoongArch: Fix address space mismatch in kexec command line lookup

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexecload2 path filemode == 0 passes the user-space segment buffer straight to strncmp...

EUVD-2026-57043

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexecload2 path filemode == 0 passes the user-space segment buffer straight to strncmp...

CVE-2026-68435 LoongArch: Fix address space mismatch in kexec command line lookup

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexecload2 path filemode == 0 passes the user-space segment buffer straight to strncmp...

CVE-2026-68435

CVE-2026-68435 affects the Linux kernel on LoongArch. The issue arises in kexec_load when scanning loaded segments for the kexec marker: the code passes a user-space buffer through a kernel cast to char *, dereferencing a user pointer in kernel context. The fix copies a marker-sized prefix of eac...

PT-2026-70949

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexec load2 path file mode == 0 passes the user-space segment buffer straight to strnc...

UBUNTU-CVE-2026-68179

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...

CVE-2026-68179 misc: nsm: only unlock nsm_dev on post-lock error paths

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...

CVE-2026-64264

CVE-2026-64264 (Linux kernel) concerns a bug in fuse_uring_commit where copy_from_user error handling clobbers a negative errno with the positive residual, causing FUSE callers to see a successful (but potentially incomplete) reply. The root cause is that when an error occurs, err is a positive r...

EUVD-2026-48976

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...