UBUNTU-CVE-2026-98735

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize ACL scheduling with channel deletion hcichansent selects a channel under RCU but drops the read lock before accessing chan-conn and returning the channel. The ACL and LE schedulers then use its packe...

UBUNTU-CVE-2026-98742

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client-ioctlmutex, but the translated port-info compat path invokes the same handlers through sndseqkernelclientctl withou...

UBUNTU-CVE-2026-98734

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown hcilowsent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...

UBUNTU-CVE-2026-98733

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize fragmented ISO packet queueing The fragmented path in hciqueueiso calls skbqueuetail without holding conn-dataq.lock. The socket lock serializes senders, but the transmit worker can concurrently remo...

UBUNTU-CVE-2026-98599

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stackslotobjgetspi bpfgetspi computes -off - 1 / BPFREGSIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8...

UBUNTU-CVE-2026-98598

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

UBUNTU-CVE-2026-98596

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

CVE-2026-98787

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in rhtabmaplookupanddeletebatch bpfmemcachefreercu uses thiscpuptr which requires migration to be disabled. All callers of rhtabdeleteelem disable migration except rhtabmaplookupanddeletebatc...

UBUNTU-CVE-2026-98755

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

UBUNTU-CVE-2026-98672

In the Linux kernel, the following vulnerability has been resolved: iio: adc: stm32-adc: fix possible division by zero in processed channel In case the conversion has failed or returned zero, processing val can lead to a division by zero. Need to check for errors, or converted value is zero, befo...

CVE-2026-98600

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

CVE-2026-98534

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy newpolicy audits the policy after ipenewpolicyfsnode publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while...

UBUNTU-CVE-2026-98571

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf-page after recycling on skb build failure In stmmacrx, when napibuildskb fails the descriptor page is recycled back to the page pool with pagepoolrecycledirect, but buf-page is left pointing at the...

UBUNTU-CVE-2026-98731

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...

UBUNTU-CVE-2026-98741

In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detectusbformat cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize...

UBUNTU-CVE-2026-98827

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: bound TX aggregation to MAXTXBUFSIZE hifusbtx dequeues up to MAXTXAGGRNUM 20 frames into a single txbuf of MAXTXBUFSIZE 32768 bytes, limiting the batch by record count but never by cumulative byte length. With lar...

UBUNTU-CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

UBUNTU-CVE-2026-98840

In the Linux kernel, the following vulnerability has been resolved: vcscreen: reload vc pointer before if ret in vcswrite to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vcscreen: reload load of struct vcdata pointer in vcswrite to avoid UAF" sits after the 'if ret' block, so the...

UBUNTU-CVE-2026-98709

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211vifusereservedswitch validates a replacement by counting assigned links on ctx-replacectx and treating reservations too broadly. A link can still be...

UBUNTU-CVE-2026-98805

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix ...