UBUNTU-CVE-2026-98360

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcgtree only after rxemcastadd succeeds rxegetmcg publishes a newly allocated multicast group in rxe-mcgtree before programming the backing Ethernet multicast address with rxemcastadd, which runs outside...

CVE-2026-98190

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...

CVE-2026-98282

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommutcecheckioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommutcecheckioba. While doing so, the passed ...

UBUNTU-CVE-2026-98210

In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: cancel data work and watchdog on remove mxcmciremove frees the host through the devm tail, but neither it nor mmcremovehost drains the driver's own asynchronous state. host-watchdog, a 10 s timer armed on the DMA pat...

UBUNTU-CVE-2026-98290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98276

In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sockgettstamp sk-skflags must only be changed while holding the socket lock, because socksetflag and sockresetflag use non atomic operations setbit and clearbit. sockgettstamp is one of the last places whe...

CVE-2026-98311

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

CVE-2026-98362

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...

CVE-2026-98365

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

UBUNTU-CVE-2026-98192

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

CVE-2026-98331

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs from the local-interfaces list when an interface is removed via ieee80211ifremove, before it unregisters the netdev. However, it's possible...

CVE-2026-98339

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211updateassocbssentry removes that entry before rehashing the real one, since the two...

UBUNTU-CVE-2026-98195

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...

CVE-2026-98363

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...

CVE-2026-98184

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiexcfg80211authenticate derives the authentication frame length from req-ielen and req-authdatalen, both of type sizet, but stores it in a u16. NL80211ATTRAUTHDATA...

UBUNTU-CVE-2026-98201

In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...

UBUNTU-CVE-2026-98189

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...

UBUNTU-CVE-2026-98243

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

CVE-2026-98199

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core increase number of phases and add new mask Increase the number of phases to 16 as a new upcoming device supports such a number. While at it, add a new mask for controlling the source of the output voltage. Note...

CVE-2026-98308

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...