CVE-2026-74642

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

CVE-2026-74710

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

UBUNTU-CVE-2026-74656

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

UBUNTU-CVE-2026-74675

In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbdkeycode with ttyportttyget kbdkeycode reads vc-port.tty without acquiring a tty reference, racing against conshutdown which clears port.tty under a different lock. Use ttyportttyget/ttykrefput to...

UBUNTU-CVE-2026-74678

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...

UBUNTU-CVE-2026-74642

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

UBUNTU-CVE-2026-74609

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...

UBUNTU-CVE-2026-74723

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...

UBUNTU-CVE-2026-74710

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

UBUNTU-CVE-2026-74637

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

UBUNTU-CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

UBUNTU-CVE-2026-74655

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uartops does not provide a flushbuffer...

UBUNTU-CVE-2026-74729

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread putfifowithdiscard acts as both producer and consumer on the kfifo: it calls kfifoskip advances out and kfifoput advances in from the IRQ handler without synchronizin...

UBUNTU-CVE-2026-74686

In the Linux kernel, the following vulnerability has been resolved: rqspinlock: Reset tail when preserving queue on deadlock Currently, the destruction of the waiter queue is suppressed for rqspinlock in cases where a deadlock is detected. Deadlock checks happen relatively frequently on entry for...

UBUNTU-CVE-2026-74717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...

UBUNTU-CVE-2026-74708

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsktxmetadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the...

UBUNTU-CVE-2026-74687

In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9wdt: prevent timer rearm during teardown at91ping rearms the watchdog timer from its callback. timerdelete neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver...

UBUNTU-CVE-2026-74627

In the Linux kernel, the following vulnerability has been resolved: net: devmem: prevent net-iov / page mixing We should either have netiov or page backed frags in a single skb, otherwise it blows up down the stack. Don't allow mixing in zerocopyfillskbfromdevmem...

UBUNTU-CVE-2026-74597

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip6ip6err ip6ip6err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6send. The clone still carries the outer packet's inet6skbparm in...

UBUNTU-CVE-2026-74632

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: fix hugezeropfn race Patch series "mm/hugememory: fix hugezeropfn race", v2. There is a subtle race in the reference-counted hugezerofolio implementation. The fast path atomic logic fails to account for the fact th...