UBUNTU-CVE-2026-64369

In the Linux kernel, the following vulnerability has been resolved: s390: Revert support for DCACHEWORDACCESS loadunalignedzeropad reads eight bytes from unaligned addresses and may cross page boundaries. It handles exceptions which may happen if reading from the second page results in an...

UBUNTU-CVE-2026-64488

In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. In layout.c, the function does not check the return value before dereferencing ctl-id.name or passing to aoasndctladd, which can le...

UBUNTU-CVE-2026-64415

In the Linux kernel, the following vulnerability has been resolved: mm/swap: add condresched in swapreclaimfullclusters to prevent softlockup We hit a real softlockup in an internal stress test environment. The workload was LTP memory/swap stress on a large arm64 machine, with 320 CPUs, about 1TB...

UBUNTU-CVE-2026-64258

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

UBUNTU-CVE-2026-64427

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e "HID: logitech-dj: Prevent REPORTIDDJSHORT related user initiated OOB write" added validation for the DJ short output report, but the error pa...

UBUNTU-CVE-2026-64370

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

UBUNTU-CVE-2026-64333

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the u...

UBUNTU-CVE-2026-64384

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2notifyinit fails before the next send, cleanup retains the previous buffer type and...

UBUNTU-CVE-2026-64494

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002readraw calls pmruntimegetsync before reading the lux value, but if gp2ap002getlux fails, it returns directly. This skips the pmruntimeputautosuspend call at the "ou...

UBUNTU-CVE-2026-64316

In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use printhexdumpdevel to guard key hex dumps Use printhexdumpdevel for dumping sensitive key material in setkey and gensplitkey to avoid leaking secrets at runtime when CONFIGDYNAMICDEBUG is enabled...

UBUNTU-CVE-2026-64378

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the following BUGON is occasionally triggered: ================================================================== VFS: Busy inodes after...

UBUNTU-CVE-2026-64451

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in funcsetflag funcsetflag dereferences tr-currenttraceflags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from...

UBUNTU-CVE-2026-64428

In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use rawspinlockt in the irq startup path schirqunmask enables the GPIO IRQ and then updates the controller state through schirqmaskunmask, which takes sch-lock with spinlockirqsave. The callback can be reached from...

UBUNTU-CVE-2026-64506

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

UBUNTU-CVE-2026-64309

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCOMMIT Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

UBUNTU-CVE-2026-64285

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guestmemfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the...

UBUNTU-CVE-2026-64404

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in isoconnbigsync isoconnbigsync drops the socket lock to call hcigetroute and then re-acquires it, but dereferences isopisk-conn-hcon afterwards without re-checking that conn is still...

UBUNTU-CVE-2026-64324

In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the...

UBUNTU-CVE-2026-64368

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to origsize when only red zoning is enabled When init zeroing on allocation is requested, for kmalloc we generally have to zero the full object size even if a smaller size is requested, in order to...

UBUNTU-CVE-2026-64492

In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devmiiotriggerregister tmp006probe allocates the DRDY trigger with devmiiotriggeralloc but registers it with plain iiotriggerregister. The driver has no .remove callback, so on module unload the...