UBUNTU-CVE-2026-89590

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

UBUNTU-CVE-2026-89454

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix IRQ domain leaks in the error paths of pldainitinterrupts pldainitinterrupts initializes IRQ domains and creates IRQ mapping but does not unwind them when later step fails. If platformgetirq or either...

CVE-2026-80949

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmfsdioreadcontrol The memory allocated for buf is not freed in some of the error paths in brcmfsdioreadcontrol. Fix that by adding vfree calls. arend: rework as suggested by Johannes...

CVE-2026-80948

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart In iwlopmodedvmstart, jumping to outfreeeeprom currently bypasses the outfreeeepromblob label. Consequently, error paths triggered after successfully parsing the EEPROM fre...

CVE-2026-89544

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

CVE-2026-80949

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmfsdioreadcontrol The memory allocated for buf is not freed in some of the error paths in brcmfsdioreadcontrol. Fix that by adding vfree calls. arend: rework as suggested by Johannes...

CVE-2026-89582

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

DEBIAN-CVE-2026-80941

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

CVE-2026-80942

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92duinitswvars The memory allocated inside rtl92duinitshareddata is not freed in any of the subsequent error paths in rtl92duinitswvars. Fix that by adding a call to...

DEBIAN-CVE-2026-80942

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92duinitswvars The memory allocated inside rtl92duinitshareddata is not freed in any of the subsequent error paths in rtl92duinitswvars. Fix that by adding a call to...

CVE-2026-80940

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: pci: fix resource leak on failed NAPI setup rtwpciprobe allocates PCI resources through rtwpcisetupresource before it sets up NAPI. If rtwpcinapiinit fails, the error path jumps straight to errpcideclaim and skips...

UBUNTU-CVE-2026-80941

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

CVE-2026-80942

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92duinitswvars The memory allocated inside rtl92duinitshareddata is not freed in any of the subsequent error paths in rtl92duinitswvars. Fix that by adding a call to...

CVE-2026-80940

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: pci: fix resource leak on failed NAPI setup rtwpciprobe allocates PCI resources through rtwpcisetupresource before it sets up NAPI. If rtwpcinapiinit fails, the error path jumps straight to errpcideclaim and skips...

CVE-2026-80941

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

UBUNTU-CVE-2026-80942

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92duinitswvars The memory allocated inside rtl92duinitshareddata is not freed in any of the subsequent error paths in rtl92duinitswvars. Fix that by adding a call to...

CVE-2026-89769 clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhpsetupstate error path When cpuhpsetupstate fails after pitclockeventpercpuinit has successfully called requestirq, the error handling jumps directly to outpitclocksourceunregister...

CVE-2026-89769

CVE-2026-89769 affects the NXP PIT (Programmable Interrupt Timer) clocksource driver in the Linux kernel. The root cause is an IRQ leak on the cpuhp_setup_state error path: when this call fails after request_irq has succeeded, the cleanup path skips releasing the IRQ. Because kfree(pit) follows, ...

CVE-2026-89733 usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

EUVD-2026-76503

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...