CVE-2026-98794

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

UBUNTU-CVE-2026-98748

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

UBUNTU-CVE-2026-98779

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

UBUNTU-CVE-2026-98739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

UBUNTU-CVE-2026-98735

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize ACL scheduling with channel deletion hcichansent selects a channel under RCU but drops the read lock before accessing chan-conn and returning the channel. The ACL and LE schedulers then use its packe...

UBUNTU-CVE-2026-98721

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ before initializing them leaves a window in which a pending...

UBUNTU-CVE-2026-98677

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix use-after-free on unbind adsdbufferpostenable allocates sigmadelta-samplesbuf with devmkrealloc at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are...

UBUNTU-CVE-2026-98662

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irqwork after freeirq The threaded IRQ handler queues data-work through irqworkqueue so the trigger is polled from a per-CPU context. freeirq does not flush an irqwork the handler already queued, s...

UBUNTU-CVE-2026-98663

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16480: fix unprotected debugfs reads The firmwarerevision and firmwaredate file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does...

UBUNTU-CVE-2026-98664

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400serialnumberfops is open coded and never calls debugfsfileget, so debugfsremoverecursive does not wait for a read in progress and unbind frees the iiodev underneath it...

UBUNTU-CVE-2026-98679

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013writeeventconfig already ignores repeated enable requests, but a repeated disable reques...

UBUNTU-CVE-2026-98666

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does not wait for a read ...

UBUNTU-CVE-2026-98742

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client-ioctlmutex, but the translated port-info compat path invokes the same handlers through sndseqkernelclientctl withou...

UBUNTU-CVE-2026-98694

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

UBUNTU-CVE-2026-98857

In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...

UBUNTU-CVE-2026-98862

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in killrules killrules removes mixed AUDITDIR and AUDITEXE rules when an audit tree is pruned. It drops entry-rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been...

UBUNTU-CVE-2026-98856

In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, getoptimizedkprobe stops at B when arming a new probe C at A+4. It leaves A...

UBUNTU-CVE-2026-98836

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized from the OUT endpoint, but the number of bytes written into that slice...

UBUNTU-CVE-2026-98840

In the Linux kernel, the following vulnerability has been resolved: vcscreen: reload vc pointer before if ret in vcswrite to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vcscreen: reload load of struct vcdata pointer in vcswrite to avoid UAF" sits after the 'if ret' block, so the...

UBUNTU-CVE-2026-98838

In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles BUG Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fbpadalignedbuffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4...