CVE-2026-72157

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding framecount tbnetpoll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...

UBUNTU-CVE-2026-72158

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit is se...

UBUNTU-CVE-2026-72066

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGESIZE buffer. Use sysfsemitat ...

UBUNTU-CVE-2026-72211

In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfsirreparent moves the resident index root entries into an index block and leaves a small root stub containing the child VCN. That root stub can be larger than the...

UBUNTU-CVE-2026-72232

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

UBUNTU-CVE-2026-72046

In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...

CVE-2026-72197

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

UBUNTU-CVE-2026-72199

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEXROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those check...

UBUNTU-CVE-2026-72099

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hashoffset twice hashoffset is already incremented in the loop "for i = 0; i tocopy; i++, ts--". Do not increment it again...

UBUNTU-CVE-2026-72157

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding framecount tbnetpoll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...

CVE-2026-72098

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if neras && neras fec-roots fio-erasuresneras++ = i; This allows neras to reach roots + 1 the post-increment pushes it past roots. This...

CVE-2026-72241

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...

CVE-2026-72226

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. The size can therefore...

CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72030

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...

UBUNTU-CVE-2026-72114

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

UBUNTU-CVE-2026-72044

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

UBUNTU-CVE-2026-72150

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprtcreateargs structure The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. While some fields are manually populated, critical fields like...

UBUNTU-CVE-2026-72241

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...

UBUNTU-CVE-2026-72201

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...