CVE-2026-98773

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

UBUNTU-CVE-2026-98507

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anonvma init and vma-anonvma publish On arm64 server, we find that a task trying to grab the anonvma lock triggers hungtask. INFO: task main:2354726 blocked for more than 120 seconds. Tainted:...

UBUNTU-CVE-2026-98705

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

UBUNTU-CVE-2026-98577

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

UBUNTU-CVE-2026-98634

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

CVE-2026-98523

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

UBUNTU-CVE-2026-98762

In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2wakeupdetected accesses the DWC2 host state and can rearm the wakeup timer. dwc2hcdfree currently deletes the timer only after freeing host-owned state, and timerdele...

UBUNTU-CVE-2026-98749

In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100shutdown stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100shutdown...

UBUNTU-CVE-2026-98655

In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with excludekernel=1 can be opened without kernel perf access. However, excludekernel does not suppress text-poke sideband records. Every PERFRECORDTEXTPOKE is marked...

UBUNTU-CVE-2026-98725

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge nvmetauthchallenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A shor...

UBUNTU-CVE-2026-98584

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

UBUNTU-CVE-2026-98804

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix use-after-free in pagepoolrecycleringbulk With CONFIGPAGEPOOLSTATS=y, pagepoolrecycleringbulk updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool...

UBUNTU-CVE-2026-98847

In the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state before requesting alarm IRQ devmrequestirq enables the interrupt before it returns, so the handler may run while probe is still initializing the device. Initialize the MMIO address and spinlock...

UBUNTU-CVE-2026-98767

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When dwc3checkeventbuf reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 "usb: dwc3: gadget: check that event count does not exceed even...

UBUNTU-CVE-2026-98667

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clkinitdata and clkparentdata The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to...

UBUNTU-CVE-2026-98745

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When systemsupportssme is true but systemsupportssve is false, restoring a specifically crafted SVE signal context can result in the task erroneously havi...

UBUNTU-CVE-2026-98796

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

UBUNTU-CVE-2026-98512

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

UBUNTU-CVE-2026-98550

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

UBUNTU-CVE-2026-98515

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...