CVE-2026-74378

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in getsrqwqe getsrqwqe reads wqe-dma.numsge from the shared receive queue buffer, which is mapped into userspace. It validates numsge against maxsge, but then re-reads the same field to calculat...

UBUNTU-CVE-2026-74402

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths were failing to provide valid entropy due to improper buffer management. Reading the buffer starting from byte 1, only fetch the ...

UBUNTU-CVE-2026-74435

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpcverifydata ensure rxdecbuffer alloc rxrpcrecvmsgdata calls rxrpcverifydata whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However,...

UBUNTU-CVE-2026-74409

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

UBUNTU-CVE-2026-72334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

UBUNTU-CVE-2026-72301

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...

UBUNTU-CVE-2026-72296

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETHHLEN to be pullable in ifedecode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to ethtypetrans, which expects the inner...

UBUNTU-CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

UBUNTU-CVE-2026-72399

In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdpframe The size of xdpredirectarr array is ENETCMAXSKBFRAGS. However, the number of fragments contained in xdpframe may be greater than or equal to ENETCMAXSKBFRAGS, which will cau...

UBUNTU-CVE-2026-74381

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

UBUNTU-CVE-2026-74306

In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix fpos race in qatvfresumewrite qatvfresumewrite checks filp-fpos before taking migf-lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurrent write...

UBUNTU-CVE-2026-72473

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rlkref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdmareq could return to its free...

UBUNTU-CVE-2026-74332

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

UBUNTU-CVE-2026-72309

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in traceremoteallocbuffer error path If page allocation fails in traceremoteallocbuffer, desc-nrcpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rbdesc will not...

CVE-2026-72300

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-74271

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

CVE-2026-74417

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeonalignpitch radeonalignpitch has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned cpp' calculation can overflow signed int. ...

CVE-2026-74381

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

UBUNTU-CVE-2026-72370

In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bioiovitergetpages or the bounce helper succeeds but builds a short bio, the REQATOMIC size check rejects it before submission. The old error path only dropped the bio reference...

UBUNTU-CVE-2026-72327

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...