CVE-2026-74488

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the resulting subframes. For each subframe it passes the subframe data pointe...

CVE-2026-74531

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-74522

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74471

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of registerevent in tracemoduleaddevents tracemoduleaddevents ignores the return value of registerevent and unconditionally calls addeventtotracers for each event. If registerevent fails for example, i...

CVE-2026-74540

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2capleconnectrsp l2capleconnectrsp obtains a channel via l2capgetchanbyident but neither holds a reference nor uses l2capchanholdunlesszero before locking and operating on it. A concurrent l2capchand...

UBUNTU-CVE-2026-74528

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

UBUNTU-CVE-2026-74513

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

UBUNTU-CVE-2026-74446

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold eventmutex while checkpointing CRIU events kfdcriucheckpointevents counts the entries in p-eventidr via kfdgetnumevents, allocates an array sized to that count, and then walks the same IDR to fill it. Neither the...

UBUNTU-CVE-2026-74471

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of registerevent in tracemoduleaddevents tracemoduleaddevents ignores the return value of registerevent and unconditionally calls addeventtotracers for each event. If registerevent fails for example, i...

UBUNTU-CVE-2026-74512

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in auditdelrule auditdelrule destroys e-rule.exe via auditremovemarkrule before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in auditfilte...

UBUNTU-CVE-2026-74518

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocatefileregionentries allocatefileregionentries tops up resv-regioncache with freshly allocated fileregion descriptors. The allocation uses GFPKERNEL, so resv-lock is dropped around it: the...

UBUNTU-CVE-2026-74545

In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtasestartxmit, when the head buffer DMA mapping fails after rtasexmitfrags has mapped all fragments, the error path clears the fragment descriptors with...

UBUNTU-CVE-2026-74496

In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate foucreate publishes struct fou through skuserdata before adding the new FOU port to the per-netns list. If fouaddtoportlist fails, the error path frees fou while it is still reachable through...

UBUNTU-CVE-2026-74529

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

UBUNTU-CVE-2026-74509

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix advertising data UAFs hcifindadvinstance returns an advinfo pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some...

UBUNTU-CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

UBUNTU-CVE-2026-74505

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fix UAF at error handling during probe Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot a pending URB before freeing the resources, which may lead to a...

CVE-2026-74577

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74575 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...