AZL-96201 CVE-2026-74531 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

UBUNTU-CVE-2026-74531

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

EUVD-2026-59707

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of struct userstruct on every invocation. But we don't decrement the count...

CVE-2026-74514 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of struct userstruct on every invocation. But we don't decrement the count...

CVE-2026-74514 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of struct userstruct on every invocation. But we don't decrement the count...

CVE-2026-74514

Summary of CVE-2026-74514 (Linux kernel, KVM on s390): The issue arises in memory accounting for pinned/unpinned pages where account_mem() and unaccount_mem() call get_uid() multiple times without corresponding free_uid() calls, potentially leaving a reference on the wrong process context. The bu...

CVE-2026-74340

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

CVE-2026-72469

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDRCHANGE rpcrdmacmeventhandler falls through to the disconnected: label on RDMACMEVENTADDRCHANGE and calls rpcrdmaepput with no matching get when the event arrives before RDMACMEVENTESTABLISHE...

CVE-2026-72463

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb-dev refcnt until after transportfinish. However, xfrmrcvcb may modify skb-dev to tunnel dev without taking device reference, such as vtircvcb. T...

CVE-2026-72315

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix busy dentry warning on unmount after DIO Commit c68337442f03 "cifs: Fix busy dentry used after unmounting" fixed the issue in cifs where deferred close of a file led to a dentry reference count not being released...

CVE-2026-74340

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

UBUNTU-CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72469

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDRCHANGE rpcrdmacmeventhandler falls through to the disconnected: label on RDMACMEVENTADDRCHANGE and calls rpcrdmaepput with no matching get when the event arrives before RDMACMEVENTESTABLISHE...

UBUNTU-CVE-2026-72315

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix busy dentry warning on unmount after DIO Commit c68337442f03 "cifs: Fix busy dentry used after unmounting" fixed the issue in cifs where deferred close of a file led to a dentry reference count not being released...

CVE-2026-72376

In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net-cellsoutstanding Fix net-cellsoutstanding being incremented before the check for failure of idralloccyclic, leaving the count incremented on error...

UBUNTU-CVE-2026-72463

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb-dev refcnt until after transportfinish. However, xfrmrcvcb may modify skb-dev to tunnel dev without taking device reference, such as vtircvcb. T...

CVE-2026-72178

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damoncommittarget puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid...

CVE-2026-72108

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...

CVE-2026-72095

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dmafencededuparray robust against 0-count input dmafencededuparray returns 1 when called with numfences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This contradicts bot...

UBUNTU-CVE-2026-72095

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dmafencededuparray robust against 0-count input dmafencededuparray returns 1 when called with numfences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This contradicts bot...