UBUNTU-CVE-2026-98844

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

UBUNTU-CVE-2026-98843

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

UBUNTU-CVE-2026-98856

In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, getoptimizedkprobe stops at B when arming a new probe C at A+4. It leaves A...

UBUNTU-CVE-2026-98863

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GETNESTEDSTATEPAGES if getting said pages fails Re-pend GETNESTEDSTATEPAGES before exiting to userspace if getting the nested pages fails in the KVMRUN path. If userspace re-runs the vCPU, and vmcs02 holds valid...

UBUNTU-CVE-2026-98862

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in killrules killrules removes mixed AUDITDIR and AUDITEXE rules when an audit tree is pruned. It drops entry-rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been...

UBUNTU-CVE-2026-98861

In the Linux kernel, the following vulnerability has been resolved: fprobe: Use guardrcuschednotrace and check rcuiswatching unregisterfprobe and unregisterfprobeasync used by BPF kprobe-multi rely on standard RCU grace periods synchronizercu and callrcu to wait until in-flight fprobe handlers...

UBUNTU-CVE-2026-98853

In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inetgsosegment or ipv6gsosegment for each nested IP header. encaplevel tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stac...

UBUNTU-CVE-2026-98854

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered ofoverlayfdtapply stores the idralloc return value in ovcs-id before checking it. On failure the stored id is negative, freeoverlaychangeset's "if ovcs-id" check passes...

UBUNTU-CVE-2026-98858

In the Linux kernel, the following vulnerability has been resolved: iouring: fix taskwork add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs taskwork off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscqpush has published it. I...

UBUNTU-CVE-2026-98857

In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...

UBUNTU-CVE-2026-98867

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cachekeydecode takes a key's logical off from the cache device and later indexes reqkeytree-subtrees by it in getsubtree. An off past the device forms a subtree point...

UBUNTU-CVE-2026-98833

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

UBUNTU-CVE-2026-98831

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

UBUNTU-CVE-2026-98835

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...

UBUNTU-CVE-2026-98834

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtdotpnvmemadd unregisters the user device but leaves mtd-otpusernvmem set. On an error, the caller...

UBUNTU-CVE-2026-98837

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setupcard registers the input device, whose name and phys point into struct sndusbcaiaqdev, and then goes on to sndcardregister and sndusbcaiaqcontrolinit. If either fails...

UBUNTU-CVE-2026-98810

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

UBUNTU-CVE-2026-98803

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than dmabufsz, the DMA scatters it across multiple RX descriptors rx Scatter-Gather. The secondary RX buffer secpage was only allocated and programmed whe...

UBUNTU-CVE-2026-98802

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advancenextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6nextcsidadvancearg has t...

UBUNTU-CVE-2026-98801

In the Linux kernel, the following vulnerability has been resolved: net: restrict SORESERVEMEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SORESERVEMEM" and commit d00c8ee31729 "net: fix possible NULL deref in sockreservememory" only checked skhasaccountsk,...