CVE-2026-98203

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

CVE-2026-98334

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211startap can set enablebeacon and beaconint and fail later, leaving it set forever. Scanning can then attempt to restore beaconing on such an interface, leading to: Oops:...

CVE-2026-98260

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...

CVE-2026-98240

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

CVE-2026-98222

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

UBUNTU-CVE-2026-98247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

UBUNTU-CVE-2026-98192

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

UBUNTU-CVE-2026-98268

In the Linux kernel, the following vulnerability has been resolved: perf: Fix null pointer access in isincludeguestevent A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is something like: .. pmudetachevent...

UBUNTU-CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

UBUNTU-CVE-2026-98306

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

UBUNTU-CVE-2026-98368

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

UBUNTU-CVE-2026-98184

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiexcfg80211authenticate derives the authentication frame length from req-ielen and req-authdatalen, both of type sizet, but stores it in a u16. NL80211ATTRAUTHDATA...

UBUNTU-CVE-2026-98318

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...

CVE-2026-98335

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211stopmesh leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably f...

UBUNTU-CVE-2026-98363

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...

UBUNTU-CVE-2026-98221

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...

UBUNTU-CVE-2026-98271

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: do not leave stale header offsets after pskbcarve pskbcarveinsideheader and pskbcarveinsidenonlinear remove the first bytes of a packet and reallocate skb-head. All the headers that were present before the operation...

DEBIAN-CVE-2026-98179

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix rmmio iounmap skipped on device removal amdgpupciremove calls drmdevunplug before finisw, so drmdeventer is already false there and the iounmap guarded by it is skipped. This .remove path runs on both hot-unplug a...

UBUNTU-CVE-2026-98328

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

UBUNTU-CVE-2026-98273

In the Linux kernel, the following vulnerability has been resolved: x86/kprobes: Fix crash when probing CS CALL instructions When using eBPF to probe CS CALL instructions within a function, a crash can be triggered. The eBPF tool probes offset 257 of the hrtimerrunqueues function: : nopl...