CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

UBUNTU-CVE-2026-89567

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nrtoscan. Busy buffers therefore do not consume the scan budget. If a...

UBUNTU-CVE-2026-80982

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

UBUNTU-CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-89609

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfsexorcisedaemon drops queued messages from a dying daemon without holding ecryptfsmsgctxlistsmux, but ecryptfsmsgctxalloctofree requires that lock. Take the list...

UBUNTU-CVE-2026-89517

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix rq-corepick corruption under core scheduling Core scheduling's picknexttask picks what to run on every SMT sibling of the core in a single pass under the shared core-wide rq lock. The selection state is consistent...

UBUNTU-CVE-2026-89521

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle picktask releasing the rq lock Core scheduling's picknexttask breaks when a -picktask implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

CVE-2026-89501

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpubuffer::lock when resizing a subbuf Because, ringbuffersubbuforderset can clear cpubuffer-freepage, hold cpubuffer-lock to prevent races with ringbufferallocreadpage and ringbufferfreereadpage...

CVE-2026-89662

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89508

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

UBUNTU-CVE-2026-89566

In the Linux kernel, the following vulnerability has been resolved: jbd2: check needresched when skipping busy checkpoint buffers journalshrinkonecplist skips busy checkpoint buffers when called with JBD2SHRINKBUSYSKIP. The continue statement on this path also skips the needresched check at the e...

UBUNTU-CVE-2026-89520

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's picknexttask operates on all sibling rqs under one acquisition of the shared core-wide lock. A -picktask that releases the rq lock leaves every...

UBUNTU-CVE-2026-80954

In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev-desc in i3cdevicegetsupportedxfermode i3cdevicegetsupportedxfermode uses dev-desc to obtain the master controller. However, dev-desc must not be dereferenced unless bus-lock is held, and this...

UBUNTU-CVE-2026-89491

In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hblivelock in o2hbregionpin Patch series "ocfs2: cluster: o2hbregionpin fixes", v2. This series fixes three related issues in o2hbregionpin, all are from the original implementation in...

UBUNTU-CVE-2026-89447

In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...

UBUNTU-CVE-2026-89508

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

UBUNTU-CVE-2026-81001

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in slsync slipdevs stores bare netdevice pointers and takes no reference on them. slsync and slalloc walk that table from slipopen under rtnllock, while an entry is dropped by slfreenetdev, which slsetup...

UBUNTU-CVE-2026-89670

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89759

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleakscan scans every task stack under one rcureadlock with no reschedule point, which can trip the...

EUVD-2026-76671

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleakscan scans every task stack under one rcureadlock with no reschedule point, which can trip the...