UBUNTU-CVE-2026-98518

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...

UBUNTU-CVE-2026-98650

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix potential races in dat skey functions When datcondsetstoragekey finds a large page, it will conditionally set the storage key in absolute memory using largecrstetophys to get the absolute address. There is a race...

UBUNTU-CVE-2026-98604

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

UBUNTU-CVE-2026-98603

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind-local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an...

UBUNTU-CVE-2026-98618

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNICMAXTXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

UBUNTU-CVE-2026-98570

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push plus dstdevoverhead, then push the new headers and rebuild the mac...

UBUNTU-CVE-2026-98543

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...

UBUNTU-CVE-2026-98613

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...

UBUNTU-CVE-2026-98563

In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylinkbringupphy stores the PHY in pl-phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phyeeerxclockstop can fail with a real MDIO error...

UBUNTU-CVE-2026-98693

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tbstop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprxwork still in flight which holds its own tunnel reference and the...

UBUNTU-CVE-2026-98560

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

UBUNTU-CVE-2026-98868

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment cachereplay, the writeback worker and the GC worker read a kset of getksetonmediasize bytes and advance the position by it. A forged keynum makes that size exceed the segment's...

UBUNTU-CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

UBUNTU-CVE-2026-98821

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...

UBUNTU-CVE-2026-98786

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

UBUNTU-CVE-2026-98788

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

UBUNTU-CVE-2026-98723

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pcrefs Commit 6202783184bf "nvmet: Improve nvmetallocctrl interface and implementation" added a second uuidcopy of args-hostid near the end of nvmetallocctrl, and commit...

UBUNTU-CVE-2026-98776

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

UBUNTU-CVE-2026-98817

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...

UBUNTU-CVE-2026-98747

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...