CVE-2026-74351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

UBUNTU-CVE-2026-74348

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

UBUNTU-CVE-2026-74351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

UBUNTU-CVE-2026-72337

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...

UBUNTU-CVE-2026-72340

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

CVE-2026-72144

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-laptop: fix missing cleanups in init error path dellinit initializes several resources after dellsetuprfkill, including the optional touchpad LED, keyboard backlight LED, battery hook, debugfs directory and...

CVE-2026-72144

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-laptop: fix missing cleanups in init error path dellinit initializes several resources after dellsetuprfkill, including the optional touchpad LED, keyboard backlight LED, battery hook, debugfs directory and...

UBUNTU-CVE-2026-72047

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210testintdriverwrite and ca8210testintuserread exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to...

UBUNTU-CVE-2026-72144

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-laptop: fix missing cleanups in init error path dellinit initializes several resources after dellsetuprfkill, including the optional touchpad LED, keyboard backlight LED, battery hook, debugfs directory and...

CVE-2026-74351 ocfs2: rebase copied fsdlm LVB pointers in locking_state

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

CVE-2026-74351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

CVE-2026-74351

CVE-2026-74351 affects the Linux kernel OCFS2 locking state. The root cause is a use-after-free risk where the debugfs iterator copies ocfs2_lock_res with a non-NULL sb_lvbptr that still points to an original lockres owner after teardown, leading to a freed container being accessed during dump. T...

CVE-2026-74351 ocfs2: rebase copied fsdlm LVB pointers in locking_state

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

EUVD-2026-59498

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

CVE-2026-74348 ocfs2/dlm: require a ref for locking_state debugfs open

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

CVE-2026-74348

CVE-2026-74348 affects the Linux kernel, specifically the ocfs2/dlm path for locking_state debugfs opens. The root cause is that debug_lockres_open() calls dlm_grab(dlm) but ignores its return value; after the last domain unregisters, dlm_grab() can return NULL, yet open stores the raw pointer an...

CVE-2026-74348 ocfs2/dlm: require a ref for locking_state debugfs open

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

EUVD-2026-59495

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

CVE-2026-74348

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

CVE-2026-72340 net: microchip: vcap: fix races on the shared Super VCAP block

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...