CVE-2026-98368

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

CVE-2026-98325

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98340

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, cfg80211bssupdate looks for an existing entry with the same BSSID and a hidden zero-length or NUL-filled SSID, and if ...

CVE-2026-98181

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gudplaneatomiccheck The plane property loop uses req-propertiesnumproperties + i as write index while simultaneously incrementing numproperties inside the loop. At iteration i, numproperties ha...

CVE-2026-98191

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcoreregdomainconfig gets a runtime PM reference before sending the regulatory-domain command. When wlcorecmdregdomainconfiglocked fails, the function queues...

CVE-2026-98202

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Transport drivers such as rmii2c and rmispi invoke rmidriversuspend and rmidriverresume on their child rmidev device during system power management events. Howeve...

CVE-2026-98209

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-aspeed: Remove children before releasing SDC resources Probe failure and removal leave SDHCI child devices registered after the parent clock and managed resources are released. Unregister the OF children in reverse...

CVE-2026-98255

In the Linux kernel, the following vulnerability has been resolved: tcp: exclude old ACKs from tcp fast path Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT. Such ACKs will fall through to the slow path, where tcpack performs the appropriate validation and...

CVE-2026-98343

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dmachanput and dmareleasechannel When dmadeviceput drops the last reference on chan-device-ref, dmadevicerelease runs and may free the dmadevice along with its channels. dmachanput then still read...

CVE-2026-98344

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dmachanput dmachanget takes chan-device-ref only on the slow path: / no kref on fast path / if chan-clientcount modulegetowner; chan-clientcount++; return 0; if !trymodulegetowner return...

CVE-2026-98363

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...

CVE-2026-98370

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrmstatenetlink builds the ALLOCSPI response with dumponestate, which already calls alloccompat with the response skb and header. xfrmallocuserspi then calls alloccompat again, bu...

CVE-2026-98322

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftnat: fully initialise newaddr in netmap setup nftnatsetupnetmap builds the mapped address in an on-stack union nfinetaddr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit...

CVE-2026-98272

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in pagepool allocation The per‑processor buffering scheme is supported only if the number of pools nrxqs 2 does not exceed MVPP2BMMAXPOOLS 8. This is already checked in mvpp2probe during the...

UBUNTU-CVE-2026-98197

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are not used as GPIO, w83791dprobe creates the w83791dgroupfanpwm45 sysfs group on the I2C client device. The probe error path removes this group...

UBUNTU-CVE-2026-98299

In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...

UBUNTU-CVE-2026-98285

In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion and error out in vlandel could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL...

UBUNTU-CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

UBUNTU-CVE-2026-98203

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

UBUNTU-CVE-2026-98205

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...