CVE-2026-98296

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...

CVE-2026-98300

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skbcloneandcharger for closed listener in tcpv6dorcv. tcpv6dorcv no longer calls skbcloneandcharger for TCPLISTEN since commit 073d89808c06 "net: fix data-races around sk-skforwardalloc". However, there is still a...

CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98310

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

CVE-2026-98324

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

CVE-2026-98329

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual...

CVE-2026-98330

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace is destroyed, cfg80211pernetexit moves any wiphy back to the initial namespace, and just warns if that fails. But moving an interface can fai...

CVE-2026-98341

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't free driver-owned scan requests When an interface goes down while a scan is running, cfg80211 completes the scan towards userspace and frees the scan request. However, the driver can be convinced that it own...

CVE-2026-98342

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dmadevice dmaissuependingall walks the dmadevicelist with listforeachentryrcu under rcureadlock. dmadevicerelease unlinks the device with listdelrcu and then calls...

CVE-2026-98349

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

CVE-2026-98372

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

UBUNTU-CVE-2026-98200

In the Linux kernel, the following vulnerability has been resolved: hwmon: hp-wmi-sensors Fix use-after-free in fungibleshow nsensor-currentstate is dynamically replaced as the sensor's state changes. updatenumericsensorfromwobj does this by freeing the old string and installing a new one: if...

UBUNTU-CVE-2026-98208

In the Linux kernel, the following vulnerability has been resolved: mmc: sdiouart: fix xmitfifo leak when the port table is full sdiouartaddport allocates the transmit fifo before claiming a slot in sdiouarttable. When all UARTNR slots are taken, it returns -EBUSY with the fifo still allocated, b...

UBUNTU-CVE-2026-98364

In the Linux kernel, the following vulnerability has been resolved: xfrm: hold netdevice reference under RCU in bundle creation xfrmbundlecreate and xfrmcreatedummybundle read dst-dev into a local pointer without taking a device reference, then pass it to xfrmfilldst. A concurrent RTMDELLINK...

UBUNTU-CVE-2026-98269

In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on failure to update inode for hole punching and reflinking If we fail to update the inode we error out without aborting the transaction, which can result in a persistent inconsistency if after the failur...

UBUNTU-CVE-2026-98353

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xalock, the look...

UBUNTU-CVE-2026-98361

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

UBUNTU-CVE-2026-98362

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...

UBUNTU-CVE-2026-98287

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

UBUNTU-CVE-2026-98222

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...