UBUNTU-CVE-2026-72372

In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net-cellsdynino Fix the lack of locking around modifications of net-cellsdynino by taking net-cellslock exclusively. This also requires to cell to be removed from net-cellsdynino i...

UBUNTU-CVE-2026-72429

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

CVE-2026-72288

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A writes to vcpu-B's ...

CVE-2026-72289

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgicpruneaplist drops both aplistlock and irqlock while migrating an interrupt to another vCPU. After reacquiring the locks it only checks that the affinity ...

CVE-2026-72494

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit requestdone flag, but without proper barriers around requestdone. An earlier patch by Gui-Dong Han attempted to...

CVE-2026-72484

In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure compregistervideodev allocates a videodevice with videodevicealloc and releases it if videoregisterdevice fails. This can double free the videodevice when...

CVE-2026-72394

In the Linux kernel, the following vulnerability has been resolved: hwmon: aspeed-g6-pwm-tach Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeedtachvaltorpm function calculates the fan RPM using the tachometer value. However, it does no...

CVE-2026-74268

In the Linux kernel, the following vulnerability has been resolved: tcp: clear sockops cb flags before force-closing a child socket A child socket inherits the listener's bpfsockopscbflags via skclonelock. If its setup fails in tcpv4synrecvsock / tcpv6synrecvsock, the child is freed through...

UBUNTU-CVE-2026-72416

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcompat: ebtables emulation must reject non-bridge targets xtables targets return netfilter verdicts: NFACCEPT, NFDROP, and so on. ebtables targets return incompatible verdicts: EBTACCEPT, EBTDROP, ... We cannot allo...

UBUNTU-CVE-2026-74411

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

CVE-2026-72333

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2capputident when the...

CVE-2026-72335

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

CVE-2026-72360

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FASTREQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FASTREQUEST nor EVENT messages as this would result in...

CVE-2026-72391

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers it. sfpi2cmdiobusdestroy only unregisters the bus and clears sfp-i2cm...

CVE-2026-72326

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

CVE-2026-72386

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tileroomwork, so we need to release it if the cancel was effective...

CVE-2026-72384

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irqsetchainedhandleranddata, but the remove function does not clear this handler. Thi...

CVE-2026-72351

In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE private flags can indicate that remote checksum offload metadata is present. The private flags field itself is accounted for by guehdrflagslen, but guehdrprivflagslen currently...

CVE-2026-72378

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afsextractvladdrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

CVE-2026-72390

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: Introduce slaveslock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teqlmasterxmit, teqldequeue, teqlinit...