CVE-2026-72322

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

CVE-2026-72472

In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi-rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flclock while iterating over the file lock list to...

CVE-2026-72331

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix VMA access race aie2populaterange and amdxdnaumaprelease access a saved VMA pointer that may have already been freed, leading to a potential use-after-free. Remove the VMA accesses from these functions to avoid...

CVE-2026-72383

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

CVE-2026-72469

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDRCHANGE rpcrdmacmeventhandler falls through to the disconnected: label on RDMACMEVENTADDRCHANGE and calls rpcrdmaepput with no matching get when the event arrives before RDMACMEVENTESTABLISHE...

UBUNTU-CVE-2026-72499

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-72393

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnictxlso calls skbcowhead which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in...

CVE-2026-72431

In the Linux kernel, the following vulnerability has been resolved: alloctag: fix use-after-free in /proc/allocinfo after module unload allocinfostart only reinitializes the codetag iterator at position 0. For subsequent reads position 0, it reuses cached iterator state from the previous batch...

CVE-2026-72484

In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure compregistervideodev allocates a videodevice with videodevicealloc and releases it if videoregisterdevice fails. This can double free the videodevice when...

CVE-2026-74369

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luofileunpreservefiles and luofilefinish In luofileunpreservefiles and luofilefinish, reorder moduleput and xaerase to ensure the file handler module remains pinned while its operations are being accessed...

CVE-2026-74344

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with RBROOTCACHED. It then walks the copied root and drops each object contain...

CVE-2026-72299

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipcskenqueue runs with sk-sklock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...

CVE-2026-72493

In the Linux kernel, the following vulnerability has been resolved: net: serialize netifrunning check in enqueuetobacklog Syzbot reported a KASAN slab-use-after-free in fibruleslookup. The root cause is a race condition where packets can escape the backlog flushing during device unregistration...

UBUNTU-CVE-2026-72384

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irqsetchainedhandleranddata, but the remove function does not clear this handler. Thi...

UBUNTU-CVE-2026-74329

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdogregisterdevice registers wdd-pmnb when WDOGNOPINGONSUSPEND is set, but watchdogunregisterdevice does not remove it. This leaves an embedded notifier block on the PM...

UBUNTU-CVE-2026-74421

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Switch to drmmkzalloc Driver makes use of drmmencoderinit to initialize the encoder and automatically handle the cleanup by registering drmencodercleanup with drmmaddaction. However, the internal structure...

UBUNTU-CVE-2026-74302

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory...

UBUNTU-CVE-2026-74359

In the Linux kernel, the following vulnerability has been resolved: configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the first...

UBUNTU-CVE-2026-72337

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...