UBUNTU-CVE-2026-98649

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in destroypagescrste Use READONCE in destroypagescrste to read the crste, avoid dereferencing the pointer multiple times...

UBUNTU-CVE-2026-98722

In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erasesize is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. adddevice then evaluates if size % erasesize with a zero divisor, which triggers a...

UBUNTU-CVE-2026-98714

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on VMEXIT if and only if VMRUN succeeded Leave control.erapctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavior...

UBUNTU-CVE-2026-98713

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEATFGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvmcalculatetraps...

UBUNTU-CVE-2026-98712

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the...

UBUNTU-CVE-2026-98738

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access buildpairingcmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...

UBUNTU-CVE-2026-98727

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLKFEATZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespac...

UBUNTU-CVE-2026-98726

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

UBUNTU-CVE-2026-98720

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified Force a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the runtime eVMCS controls pin, primary, secondary, etc. are being updated. If L1 isn't...

UBUNTU-CVE-2026-98719

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it Nullify haveruncpus when freeing the mask, particularly in the error path of sevguestinit, so that KVM doesn't have to subtly use sev-active to track whether or not t...

UBUNTU-CVE-2026-98715

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control i.e. pending TLB flush on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU performs the requested TLB flush if and only...

UBUNTU-CVE-2026-98716

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02 i...

UBUNTU-CVE-2026-98724

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

UBUNTU-CVE-2026-98729

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply vaalign to hugetlb mappings on AMD F15h getalignmask returns hugepagemaskalign for hugetlbfs, but getalignbits adds vaalign.bits regardless, so vmunmappedarea returns an address off the huge page boundary and...

UBUNTU-CVE-2026-98717

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

UBUNTU-CVE-2026-98708

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replacectx pointers between the old WILLBEREPLACED chanctx and the new REPLACESOTHER chanctx. However, the early free paths only consider...

UBUNTU-CVE-2026-98773

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

UBUNTU-CVE-2026-98772

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach or first open and stopped at disconnect or last close,...

UBUNTU-CVE-2026-98771

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

UBUNTU-CVE-2026-98695

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...