UBUNTU-CVE-2026-98440

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is for...

UBUNTU-CVE-2026-98638

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvmvcpuinitsve pkvmvcpuinitsve clamps only the upper bound of the host-provided svemaxvl, so an invalid vector length reaches svestatesizefromvl and the WARNON there, which is fatal ...

UBUNTU-CVE-2026-98713

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEATFGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvmcalculatetraps...

UBUNTU-CVE-2026-98728

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2getrandom When the response carries the TPM2STSESSIONS tag, tpm2getrandom skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the...

UBUNTU-CVE-2026-98729

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply vaalign to hugetlb mappings on AMD F15h getalignmask returns hugepagemaskalign for hugetlbfs, but getalignbits adds vaalign.bits regardless, so vmunmappedarea returns an address off the huge page boundary and...

UBUNTU-CVE-2026-98791

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

UBUNTU-CVE-2026-98543

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...

UBUNTU-CVE-2026-98547

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

UBUNTU-CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

UBUNTU-CVE-2026-98584

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

UBUNTU-CVE-2026-98595

In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to a specific address and port keeps its entry in the 4-tuple hash table after it is disconnected: sk binds to 127.0.0.1:21001 sk connects to...

UBUNTU-CVE-2026-98542

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...

UBUNTU-CVE-2026-98463

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

UBUNTU-CVE-2026-98448

In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...

UBUNTU-CVE-2026-98446

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

UBUNTU-CVE-2026-98528

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

UBUNTU-CVE-2026-98523

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

UBUNTU-CVE-2026-98641

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes the exceptioncb path and never calls pushcalleeregs. That is the only...

UBUNTU-CVE-2026-98683

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...

UBUNTU-CVE-2026-98844

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...