CVE-2026-72057

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb control buffe...

CVE-2026-72197

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

CVE-2026-72261

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

CVE-2026-72157

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding framecount tbnetpoll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...

CVE-2026-72030

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...

CVE-2026-72241

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...

CVE-2026-72226

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. The size can therefore...

CVE-2026-72098

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if neras && neras fec-roots fio-erasuresneras++ = i; This allows neras to reach roots + 1 the post-increment pushes it past roots. This...

CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

UBUNTU-CVE-2026-72075

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

UBUNTU-CVE-2026-72044

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

UBUNTU-CVE-2026-72114

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

UBUNTU-CVE-2026-72150

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprtcreateargs structure The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. While some fields are manually populated, critical fields like...

CVE-2026-72066

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGESIZE buffer. Use sysfsemitat ...

UBUNTU-CVE-2026-72201

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

UBUNTU-CVE-2026-72241

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...

UBUNTU-CVE-2026-72261

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

UBUNTU-CVE-2026-72025

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwrit...

UBUNTU-CVE-2026-72089

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

CVE-2026-72018

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...