UBUNTU-CVE-2026-64436

In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp SADBXSATYPEIPCOMP case by allocating x-calg and copying only the algorithm name: x-calg = kmallocobjx-calg; if !x-calg err = -ENOMEM; goto...

UBUNTU-CVE-2026-64450

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...

UBUNTU-CVE-2026-64431

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...

UBUNTU-CVE-2026-64359

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

UBUNTU-CVE-2026-64443

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

UBUNTU-CVE-2026-64499

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119triggeredbufferpreenable resumes the device with pmruntimeresumeandget before starting a conversion. If i2csmbuswritebyte fails, the function returns the erro...

CVE-2026-64527 drm/hyperv: validate VMBus packet size in receive callback

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64526 ethtool: tsconfig: fix missing ethnl_ops_complete()

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnlopscomplete tsconfigpreparedata calls ethnlopsbegin, we need to call ethnlopscomplete before returning the error...

CVE-2026-64514

CVE-2026-64514 — Linux kernel (userfaultfd) details: The vulnerability concerns a gate must_wait writability check for userfaultfd on pte_present(). The kernel reads PTEs without holding the page table lock in userfaultfd_must_wait() and userfaultfd_huge_must_wait(), potentially decoding offset b...

CVE-2026-64508

CVE-2026-64508 relates to a Linux kernel vulnerability in BPF JIT memory reuse. The issue arises when the BPF JIT allocator reuses space for new programs, potentially letting indirect jumps reuse stale branch predictions. Fix implemented: flush indirect branch predictors on JIT memory reuse via a...

CVE-2026-64484 ALSA: es1938: check snd_ctl_new1() return value

In the Linux kernel, the following vulnerability has been resolved: ALSA: es1938: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. sndes1938mixer does not check the return value before dereferencing the pointer, which can lead to a NULL pointer dereference. A...

CVE-2026-64483 ALSA: firewire: isight: bound the sample count to the packet payload

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32tocpupayload-samplecount; if...

CVE-2026-64473

In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfscreatedevmseqfile store a devres allocated debugfsdevmentry as inode private data. vfiounregistergroupdev currently calls...

CVE-2026-64456

CVE-2026-64456 affects the Linux kernel virtio-rng driver. A malicious or buggy virtio-rng backend can over-report used.len to trap memcpy past the inline data buffer, reading adjacent slab memory. This enables a potential cross-boundary data leak of guest-kernel heap contents via /dev/hwrng and ...

CVE-2026-64450

CVE-2026-64450: In Linux kernel TIPC, a broadcast Gap ACK blocks record could be read out-of-bounds due to a missing check that the record fits in the message data area. The bug occurs when tipc_get_gap_ack_blks() validates the len against ugack/bgack counts but not msg_data_sz(), allowing a reco...

CVE-2026-64450 tipc: fix out-of-bounds read in broadcast Gap ACK blocks

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...

EUVD-2026-48960

In the Linux kernel, the following vulnerability has been resolved: mm: swapcgroup: fix NULL deref in lookupswapcgroupid on swapless host lookupswapcgroupid passes swapcgroupctrltype.map to swapcgroupidlookup without checking that the type was ever registered via swapcgroupswapon. On a swapless...

CVE-2026-64414

CVE-2026-64414 : In the Linux kernel, the netfilter path handling unreadable fragments has been resolved. The issue arises when an skb with unreadable fragments (eg, from devmem TCP) is processed by the u32 module, causing skb_copy_bits() to return a negative error code. Mitigations described acr...

EUVD-2026-48955

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before findtablelock updatecounters and compatupdatecounters forward a user-supplied 32-byte table name to findtablelock without NUL-terminating it. On a lookup miss, findinlistlock calls...

CVE-2026-64408 Bluetooth: bnep: pin L2CAP connection during netdev registration

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...