CVE-2026-89734

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

CVE-2026-89729

In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensorhubgetfeature sensorhubgetfeature clamps its return value to the caller's buffer size, but the copy loop still copies field-reportsize / 8 bytes for each report value. A malicious...

CVE-2026-89738

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle: at91vbustimer schedules vbustimerwork, and at91vbustimerwork calls...

CVE-2026-89722

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pciwritelegacyio pciwritelegacyio loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if count != 1 && count != 2 && count != 4 return -EINVAL; return...

CVE-2026-89726

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

UBUNTU-CVE-2026-89771

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...

UBUNTU-CVE-2026-89741

In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in videoregisterdevice" This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a. The intentions of that patch were good, but it doesn't work. The idea is that if deviceregister...

UBUNTU-CVE-2026-89747

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...

CVE-2026-89742

In the Linux kernel, the following vulnerability has been resolved: rapidio: mportcdev: fix use-after-free in dmareqfree dmareqfree acquires bufmutex through req-map, drops the mapping reference with krefput, and then dereferences req-map again to unlock the mutex. If krefput drops the last...

UBUNTU-CVE-2026-89734

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

UBUNTU-CVE-2026-89729

In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensorhubgetfeature sensorhubgetfeature clamps its return value to the caller's buffer size, but the copy loop still copies field-reportsize / 8 bytes for each report value. A malicious...

CVE-2026-89758

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe "mm/hugememory: add device-private THP support to PMD operations" a PMD may...

CVE-2026-89750

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...

CVE-2026-89768

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backingfileopen derives the path to be stored in the new backing file from userfile-fpath. This is incorrect when userfile itself is a backing file, which is the case for nested stacking...

CVE-2026-89733

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

CVE-2026-89749

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...

CVE-2026-89759

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleakscan scans every task stack under one rcureadlock with no reschedule point, which can trip the...

CVE-2026-89751

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

AZL-100860 CVE-2026-89719 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in readblockstate readblockstate calculates nrpages before taking devlock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nrpages still describes the old...

UBUNTU-CVE-2026-89768

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backingfileopen derives the path to be stored in the new backing file from userfile-fpath. This is incorrect when userfile itself is a backing file, which is the case for nested stacking...