UBUNTU-CVE-2026-98725

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge nvmetauthchallenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A shor...

UBUNTU-CVE-2026-98706

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

UBUNTU-CVE-2026-98710

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

UBUNTU-CVE-2026-98720

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified Force a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the runtime eVMCS controls pin, primary, secondary, etc. are being updated. If L1 isn't...

UBUNTU-CVE-2026-98831

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

UBUNTU-CVE-2026-98806

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assignment when CONFIGDCB is enabled Previously, BPID assignment under CONFIGDCB assumed queuetopfcmap was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized...

UBUNTU-CVE-2026-98792

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

UBUNTU-CVE-2026-98513

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

UBUNTU-CVE-2026-98519

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpudebugfstestibshow amdgpudebugfstestibshow resumes the device with pmruntimegetsync before taking the reset domain semaphore with downwritekillable. If the write lock acquisition is...

UBUNTU-CVE-2026-98514

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

UBUNTU-CVE-2026-98502

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alpsinputconfigured allocates a second input device "DualPoint Stick" with inputallocatedevice and registers it, but the alpsdriver struct has no .remove handler and...

UBUNTU-CVE-2026-98672

In the Linux kernel, the following vulnerability has been resolved: iio: adc: stm32-adc: fix possible division by zero in processed channel In case the conversion has failed or returned zero, processing val can lead to a division by zero. Need to check for errors, or converted value is zero, befo...

UBUNTU-CVE-2026-98796

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

UBUNTU-CVE-2026-98840

In the Linux kernel, the following vulnerability has been resolved: vcscreen: reload vc pointer before if ret in vcswrite to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vcscreen: reload load of struct vcdata pointer in vcswrite to avoid UAF" sits after the 'if ret' block, so the...

UBUNTU-CVE-2026-98848

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clkhwonecelldata with countedby" annotated the hws member of 'struct clkhwonecelldata' with countedby, which informs the bounds sanitizer...

UBUNTU-CVE-2026-98833

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

UBUNTU-CVE-2026-98784

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfxv60initmicrocode is not released when the GFX block is torn down, leaking the firmware resources. Add gfxv60freemicrocode and call it from gfxv60swfini t...

UBUNTU-CVE-2026-98812

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

UBUNTU-CVE-2026-98847

In the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state before requesting alarm IRQ devmrequestirq enables the interrupt before it returns, so the handler may run while probe is still initializing the device. Initialize the MMIO address and spinlock...

UBUNTU-CVE-2026-98809

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...