UBUNTU-CVE-2026-74264

In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races Blamed commit converted the untracked devhold/devput calls in the watchdog code to use the tracked devholdtrack/devputtrack which were later renamed/interfaced to netdevhold and netdevpu...

UBUNTU-CVE-2026-72452

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intelcrtcputcolorblobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intelcrtcprepareclearedstate, which fre...

UBUNTU-CVE-2026-74343

In the Linux kernel, the following vulnerability has been resolved: kernfs: fix xattr race condition with multiple superblocks Multiple superblocks with different namespaces can share the same kernfsnode when kernfstestsuper finds a matching root but different namespace. This means multiple inode...

UBUNTU-CVE-2026-74286

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

UBUNTU-CVE-2026-72362

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

UBUNTU-CVE-2026-72424

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

UBUNTU-CVE-2026-74261

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: avoid stale FIFO cells during resize sndseqfiforesize still needs to publish the replacement pool before it waits for FIFO users. A blocking sndseqread holds f-uselock while it sleeps, so concurrent senders must be abl...

UBUNTU-CVE-2026-72454

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

UBUNTU-CVE-2026-72471

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not found within runs0, causing runlookup to return false. This causes runlookupentry to return false, which in turn results in a len value of ...

UBUNTU-CVE-2026-72374

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

UBUNTU-CVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

UBUNTU-CVE-2026-72412

In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of PAGEUNUSED pte bit The PAGEUNUSED softbit should not really be lying around. Its sole purpose is to signal to trytounmapone and trytomigrateone that the page can be discarded instead of being moved /...

UBUNTU-CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

UBUNTU-CVE-2026-72418

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e "netfilter: nftconnlimit: update the count if add was skipped" introduced a regression where packets for valid connections are dropped whe...

UBUNTU-CVE-2026-74397

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in mlx5ibenablelb. In that case, the allocated TD is leaked. Fix this by deallocatin...

UBUNTU-CVE-2026-72462

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peerpath is used The holding a reference to the peersk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with...

UBUNTU-CVE-2026-72388

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

UBUNTU-CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

UBUNTU-CVE-2026-74340

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

UBUNTU-CVE-2026-74413

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pcigetdrvdata type in AER handlers rtw89 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...