UBUNTU-CVE-2026-90161

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

UBUNTU-CVE-2026-90394

In the Linux kernel, the following vulnerability has been resolved: power: supply: sc2731charger: cancel work on remove The USB notifier and initial charger detection can schedule info-work. The remove path unregisters the notifier, but does not cancel queued or running work before the...

UBUNTU-CVE-2026-90130

In the Linux kernel, the following vulnerability has been resolved: vdpasim: fix cleanup after worker creation failure vdpasimcreate leaves vdpasim-worker as an ERRPTR when kthreadrunworker fails. The error path then drops the device reference, which releases the partially initialized simulator...

UBUNTU-CVE-2026-90367

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

UBUNTU-CVE-2026-90420

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfscleansegments syzbot reported a hung task in nilfstransactionbegin. This occurs because the cleaner ioctl falls into an infinite loop if nilfssegctorconstruct repeatedly returns -EROFS e.g. the...

UBUNTU-CVE-2026-90203

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If a negative offset is read off disk for example the offset into the decompressed fragment block, this will cause squashfscopydata to perform an out of bounds access. Fix by checking ...

UBUNTU-CVE-2026-90215

In the Linux kernel, the following vulnerability has been resolved: mtd: ubi: Release device reference on busy detach ubidetachmtddev obtains a device reference through ubigetdevice before checking whether the UBI device is busy. The busy return path drops ubi-refcount but leaves the device...

UBUNTU-CVE-2026-90385

In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to array with serializepolicy=1 The following bug has been observed with kernel 7.1.3 after adding a new rdev to an existing RAID1 array with serializepolicy enabled: Oops: 0002 1 CPU: 0...

UBUNTU-CVE-2026-90131

In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize resident iomap reads with mreclock ntfsreadiomapbeginresident walks the MFT record through ntfsattrlookup - ntfsattrfind without taking ni-mreclock, while ntfsattrrecordresize, ntfsmakeroomforattr and...

UBUNTU-CVE-2026-92500

In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the live inode state ext4hasinlinedatainode and ext4testinodestateinode, EXT4STATEMAYINLINEDATA in the writeend handlers, use the fsdata parameter...

UBUNTU-CVE-2026-90116

In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown sndmtpavoutputtimer rearms chip-timer while holding chip-spinlock and accesses the card-private mtpav state. sndmtpavfree currently takes the same lock and calls timerdelet...

UBUNTU-CVE-2026-90147

In the Linux kernel, the following vulnerability has been resolved: clk: devres: fix cleanup in devmclkgetoptionalenabledwithrate devmclkgetoptionalenabledwithrate registers its cleanup action before setting the clock rate. If setting the rate fails, it attempts to disable and unprepare a clock...

DEBIAN-CVE-2026-90089

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Validate the FW dump header length nxpprocessfwdump pulls the ACL header off the frame and then reads seqnum and buflen from a struct nxpfwdumphdr placed at skb-data, without checking that the ACL payload is...

UBUNTU-CVE-2026-90180

In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVEPENDING before entering mtiphwioctl. Removal can set that bit immediately afterwards and free dd-port in mtiphwexit while an ioctl still...

UBUNTU-CVE-2026-90226

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfcllcpgetsockopt casts optval to u32 user for putuser, so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing mintu32, len, sizeofu32 only...

UBUNTU-CVE-2026-90102

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

UBUNTU-CVE-2026-93039

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: Keep link pointers valid on realloc failure mesoncardreallocatelinks grows the DAI link and private data arrays with two consecutive krealloc calls and updates the owner pointers only after both calls have succeeded....

UBUNTU-CVE-2026-90374

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

UBUNTU-CVE-2026-92487

In the Linux kernel, the following vulnerability has been resolved: exfat: fix validsize extension over a shared writable mapping When a shared writable mapping has its validsize extended by a buffered write or a page fault, exfat zeroes the page-cache gap below the new validsize. A store through...

UBUNTU-CVE-2026-90434

In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head zisofsfillpages reads the compressed block pointer table. The error paths release the current bufferhead, the loop also releases the old bufferhead when it advances. However, the...