UBUNTU-CVE-2026-72331

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix VMA access race aie2populaterange and amdxdnaumaprelease access a saved VMA pointer that may have already been freed, leading to a potential use-after-free. Remove the VMA accesses from these functions to avoid...

UBUNTU-CVE-2026-72337

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...

CVE-2026-72328

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdnaumap lifetime race amdxdnaumaprelease calls the blocking mmuintervalnotifierremove before removing the object from abo-mem.umaplist. If aie2populaterange runs concurrently, it may obtain a...

CVE-2026-72335

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

UBUNTU-CVE-2026-72353

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

UBUNTU-CVE-2026-72422

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read by...

UBUNTU-CVE-2026-72427

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPFFPREORDER replaceeffectiveprog and purgeeffectiveprogs located the slot in the effective array by walking the program hlist and counting entries linearly. That count does not match the...

CVE-2026-72427

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPFFPREORDER replaceeffectiveprog and purgeeffectiveprogs located the slot in the effective array by walking the program hlist and counting entries linearly. That count does not match the...

UBUNTU-CVE-2026-72405

In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: prevent double queueing in udptunnelnicdevicesync Yue Sun reported a use-after-free and debugobjects warning in udptunnelnicdevicesyncwork during concurrent device operations. The workqueue core clears the interna...

CVE-2026-72390

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: Introduce slaveslock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teqlmasterxmit, teqldequeue, teqlinit...

CVE-2026-74359

In the Linux kernel, the following vulnerability has been resolved: configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the first...

CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

UBUNTU-CVE-2026-74359

In the Linux kernel, the following vulnerability has been resolved: configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the first...

CVE-2026-72422

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read by...

CVE-2026-74398

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dadfailure when state is no longer POSTDAD addrconfdadfailure transitions ifp-state from DAD to POSTDAD via addrconfdadend, which drops ifp-lock on return. The lock is re-acquired after...

UBUNTU-CVE-2026-74398

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dadfailure when state is no longer POSTDAD addrconfdadfailure transitions ifp-state from DAD to POSTDAD via addrconfdadend, which drops ifp-lock on return. The lock is re-acquired after...

CVE-2026-72431

In the Linux kernel, the following vulnerability has been resolved: alloctag: fix use-after-free in /proc/allocinfo after module unload allocinfostart only reinitializes the codetag iterator at position 0. For subsequent reads position 0, it reuses cached iterator state from the previous batch...

UBUNTU-CVE-2026-72411

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crcerrwork Upon an MDIO CRC error mxl862xxcrcerrworkfn walks the DSA ports and closes the CPU port conduits: dsaswitchforeachcpuportdp, priv-ds devclosedp-conduit;...

CVE-2026-72404

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanupbearer due to premature dstcachedestroy TIPC UDP media bearer teardown calls dstcachedestroy on its replicast caches before calling synchronizenet to wait for concurrent RCU readers transmitters to finish:...

UBUNTU-CVE-2026-72435

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfreercu and rcuassignpointer Sashiko pointed out that kfreercu was called before rcuassignpointer in handling the comment extension. Fix the order so that rcuassignpointer called first...