UBUNTU-CVE-2026-98204

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

UBUNTU-CVE-2026-98244

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

UBUNTU-CVE-2026-98302

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfpctlsetmacaddress calls ResetAdapter unconditionally, without checking netifrunning. ResetAdapter first calls cardstop, which sets smc-hw.hwstate to...

UBUNTU-CVE-2026-98348

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

UBUNTU-CVE-2026-98317

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

UBUNTU-CVE-2026-98286

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

UBUNTU-CVE-2026-98298

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

UBUNTU-CVE-2026-98342

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dmadevice dmaissuependingall walks the dmadevicelist with listforeachentryrcu under rcureadlock. dmadevicerelease unlinks the device with listdelrcu and then calls...

UBUNTU-CVE-2026-98277

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

UBUNTU-CVE-2026-98326

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

UBUNTU-CVE-2026-98206

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into responsebuf, which is CYMAXINPUT bytes...

UBUNTU-CVE-2026-98203

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

UBUNTU-CVE-2026-98198

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

UBUNTU-CVE-2026-98299

In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...

UBUNTU-CVE-2026-98361

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

UBUNTU-CVE-2026-98338

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with...

UBUNTU-CVE-2026-98327

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh-csa is allocated in ieee80211meshcsabeacon and only freed in ieee80211meshfinishcsa, i.e. when the channel switch completes. Leaving the mesh while a switch is still...

UBUNTU-CVE-2026-98283

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

UBUNTU-CVE-2026-98308

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

UBUNTU-CVE-2026-98180

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...