CVE-2026-98180

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...

CVE-2026-98245

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

CVE-2026-98195

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...

CVE-2026-98301

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

CVE-2026-98266

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix potential UAF after asynchronous card release Usually a sound driver releases the resources assigned to the card via sndcardfree, and it synchronizes with the whole release procedure. However, when the card is...

CVE-2026-98244

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

CVE-2026-98270

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check ras and obj before dereference nbiov79handlerascontrollerintrnobifring dereferences ras and obj without checking either for NULL. Both amdgpurasgetcontext and amdgpurasfindobj can return NULL, e.g. during the...

CVE-2026-98291

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix off-by-one bounds check in RX submit btintelpciesubmitrx used frbdindex rxq-count to guard the FRBD array access, allowing frbdindex == rxq-count to pass through and index one element past the end of t...

CVE-2026-98232

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its...

CVE-2026-98239

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743xrxprocessbuffer adds each non-first receive buffer to the head skb's fraglist. On the last descriptor, lan743xrxtrimskb linearizes the head and frees the fragment skb metadata...

CVE-2026-98306

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

CVE-2026-98219

In the Linux kernel, the following vulnerability has been resolved: schedext: Close the pre-enable ops error claim window scxallocandaddsched publishes ops-priv before scxrootenableworkfn switches the state to SCXENABLING. An error claimed via scxbpferrorbstr from an associated BPF program in tha...

CVE-2026-98249

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVCSETVECTORS args to the resume hvc swsusparchsuspendexit reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVCSETVECTORS and x1 is not set to...

UBUNTU-CVE-2026-98362

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...

UBUNTU-CVE-2026-98228

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-98209

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-aspeed: Remove children before releasing SDC resources Probe failure and removal leave SDHCI child devices registered after the parent clock and managed resources are released. Unregister the OF children in reverse...

CVE-2026-98255

In the Linux kernel, the following vulnerability has been resolved: tcp: exclude old ACKs from tcp fast path Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT. Such ACKs will fall through to the slow path, where tcpack performs the appropriate validation and...

CVE-2026-98251

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

UBUNTU-CVE-2026-98241

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...

UBUNTU-CVE-2026-98325

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...