UBUNTU-CVE-2026-90327

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller's buffer with mint, but then stores the value with putuserval, int user optval, which always writes sizeofint bytes. A...

UBUNTU-CVE-2026-90170

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...

UBUNTU-CVE-2026-90401

In the Linux kernel, the following vulnerability has been resolved: md: remove REQNOWAIT support from raid1/10/456 REQNOWAIT support in md personalities that can block internally is fundamentally incomplete. While reads can avoid some blocking paths, write requests can still encounter cases where...

UBUNTU-CVE-2026-90102

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

UBUNTU-CVE-2026-90257

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

UBUNTU-CVE-2026-90161

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

UBUNTU-CVE-2026-90319

In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...

UBUNTU-CVE-2026-92481

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: free EINT resources on unbind mtkeintdoinit creates an IRQ domain, populates it with a mapping for every EINT line and installs a chained handler on the parent interrupt, but none of these are ever released. Th...

UBUNTU-CVE-2026-90403

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path in rtlpciprobe, the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtlinitrfkill, ieee80211registerhw,...

UBUNTU-CVE-2026-90349

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

UBUNTU-CVE-2026-90409

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Add vmbind region with kbo range overlap check When a VM is created, caller has to specify the range of the address space carve-out set aside for mapping kernel BO's. That means vmbind mappings of UM-exposed BO's...

UBUNTU-CVE-2026-90247

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

UBUNTU-CVE-2026-90304

In the Linux kernel, the following vulnerability has been resolved: ARM: 9484/1: enable interrupts when unhandled user faults are triggered PREEMPTRT requires interrupts to be enabled when sending signals. When doDataAbort/doPrefetchAbort triggers unhandled user faults, that is inf-fn return a...

UBUNTU-CVE-2026-90171

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: release pending child sockets outside the handler lock smbdirectsocketdestroy releases the listener's pending/ready child sockets while still holding the listener's handler lock, the &idpriv-handlermutex taken via...

CVE-2026-90264

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

UBUNTU-CVE-2026-90141

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ipvsftpgetaddrport accumulates decimal digits into a u16 hport and into unsigned char p without checking for overflow. A crafted FTP PASV/EPSV response with an over-lo...

UBUNTU-CVE-2026-90183

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, checkscalechange scales down its peers, and a peer that reaches...

UBUNTU-CVE-2026-90138

In the Linux kernel, the following vulnerability has been resolved: vsock: don't check the listener's skerr in vsockaccept Syzbot reported an issue which can be reproduced with these steps: r0 = socketAFVSOCK, SOCKSTREAM, 0 bindr0, VMADDRCIDANY, PORT connectr0, VMADDRCIDLOCAL, PORT - -1, EPROTO...

UBUNTU-CVE-2026-90249

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

UBUNTU-CVE-2026-90265

In the Linux kernel, the following vulnerability has been resolved: btrfs: defrag: fix deadlock between defrag and delalloc space reservation While running fsstress with autodefrag and flushoncommit, hit a deadlock due to the fact that defrag reserves delalloc space while it's holding dirty and...