UBUNTU-CVE-2026-90130

In the Linux kernel, the following vulnerability has been resolved: vdpasim: fix cleanup after worker creation failure vdpasimcreate leaves vdpasim-worker as an ERRPTR when kthreadrunworker fails. The error path then drops the device reference, which releases the partially initialized simulator...

UBUNTU-CVE-2026-90121

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Clear per-CPU IRS data on teardown IRS affinity setup publishes an IRS pointer and IAFFID state in the per-CPU data before the remaining IRS initialization can fail. The error path then frees the IRS data without...

UBUNTU-CVE-2026-90151

In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4allocclient allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the...

UBUNTU-CVE-2026-90358

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

UBUNTU-CVE-2026-90418

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfscopydirtypages on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfscopydirtypages, which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved...

UBUNTU-CVE-2026-90157

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

UBUNTU-CVE-2026-90375

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations mt76txqueueskb overrides the wcid passed by the driver with sta-drvpriv, so the wcid might incorrectly be changed after TX, causing wcid-nonaqlpackets to be counted on th...

UBUNTU-CVE-2026-92495

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Clear VMMAYWRITE on DBR/toggle page mmap bnxtremmap rejects VMWRITE for the DBRPAGE and TOGGLEPAGE mmap flags, but a read-only mapping can still retain VMMAYWRITE. nd later be upgraded with mprotectPROTWRITE. This ca...

UBUNTU-CVE-2026-90385

In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to array with serializepolicy=1 The following bug has been observed with kernel 7.1.3 after adding a new rdev to an existing RAID1 array with serializepolicy enabled: Oops: 0002 1 CPU: 0...

UBUNTU-CVE-2026-90305

In the Linux kernel, the following vulnerability has been resolved: ARM: 9483/1: select HAVEPOSIXCPUTIMERSTASKWORK Commit c6e61c06d606 "ARM: 9463/1: Allow to enable RT" enabled PREEMPTRT on ARM but did not select HAVEPOSIXCPUTIMERSTASKWORK. This leaves CONFIGPOSIXCPUTIMERSTASKWORK disabled, so CP...

UBUNTU-CVE-2026-90166

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

UBUNTU-CVE-2026-90098

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

UBUNTU-CVE-2026-90131

In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize resident iomap reads with mreclock ntfsreadiomapbeginresident walks the MFT record through ntfsattrlookup - ntfsattrfind without taking ni-mreclock, while ntfsattrrecordresize, ntfsmakeroomforattr and...

UBUNTU-CVE-2026-93054

In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After deviceadd, the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, uioregisterdevice unwinds the device but leaves idev-info...

CVE-2026-90264

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

CVE-2026-93058

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Only fini scheduler after successful init msmringbuffernew destroys a partially initialized ring through msmringbufferdestroy when an allocation or scheduler setup step fails. If drmschedinit fails before it finishes...

UBUNTU-CVE-2026-90220

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

UBUNTU-CVE-2026-90158

In the Linux kernel, the following vulnerability has been resolved: m68k: nfcon: Do not call consoleisregistered in nfcondevice Since 7c2af0f634f1 "tty: ttyio: use consolelistlock for list synchronization" showconsactive calls the .device method under the consolelistlock, but consoleisregistered...

UBUNTU-CVE-2026-90214

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: fix streamdata leak on open error In xlnxformatterpcmopen, streamdata is allocated and adata-playstream or adata-capturestream is assigned early. If a later step, such as sndpcmhwconstraintstep or...

UBUNTU-CVE-2026-90374

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...