CVE-2026-98651

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...

CVE-2026-98649

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in destroypagescrste Use READONCE in destroypagescrste to read the crste, avoid dereferencing the pointer multiple times...

CVE-2026-98795

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98818

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

UBUNTU-CVE-2026-98503

In the Linux kernel, the following vulnerability has been resolved: packet: use ubufinfo completion for TXRING packets tpacketsnd sends skbs with frags pointing into its ring slots. Slots are released when skb-destructor is called. A call to skborphan calls skb-destructor before the skb is freed...

UBUNTU-CVE-2026-98500

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use canceldelayedworksync in remove oxphidremove uses canceldelayedwork for all three delayed work items. canceldelayedwork only dequeues a pending work item without waiting for a currently executing callback to...

UBUNTU-CVE-2026-98638

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvmvcpuinitsve pkvmvcpuinitsve clamps only the upper bound of the host-provided svemaxvl, so an invalid vector length reaches svestatesizefromvl and the WARNON there, which is fatal ...

CVE-2026-98778

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

UBUNTU-CVE-2026-98676

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000setupclkout passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls...

UBUNTU-CVE-2026-98475

In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schibconfig and schib fields as dma64t to enable automatic detection of incorrect assignments. Also a...

CVE-2026-98599

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stackslotobjgetspi bpfgetspi computes -off - 1 / BPFREGSIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8...

UBUNTU-CVE-2026-98686

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3zerorange removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data...

UBUNTU-CVE-2026-98508

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

UBUNTU-CVE-2026-98834

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtdotpnvmemadd unregisters the user device but leaves mtd-otpusernvmem set. On an error, the caller...

UBUNTU-CVE-2026-98466

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...

UBUNTU-CVE-2026-98448

In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...

UBUNTU-CVE-2026-98604

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

UBUNTU-CVE-2026-98518

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...

UBUNTU-CVE-2026-98563

In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylinkbringupphy stores the PHY in pl-phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phyeeerxclockstop can fail with a real MDIO error...

UBUNTU-CVE-2026-98767

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When dwc3checkeventbuf reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 "usb: dwc3: gadget: check that event count does not exceed even...