UBUNTU-CVE-2026-98776

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

ROS-20261019-73-0015

The vulnerability of the secattestinfo function drivers/accel/habanalabs/common/habanalabsioctl.c in the Linux kernel is related to insufficient protection of service data when processing the Pad0 field. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...

ALSA-2026:85321 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935 kernel: sctp: diag: reject stale...

UBUNTU-CVE-2026-98437

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pmruntimeresumeandget in irisenablepowerdomains to avoid leaking a runtime PM usage count on failure. Also ensure pmruntimeputsync is always called in irisdisablepowerdomains,...

UBUNTU-CVE-2026-98450

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compoundsendrecv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already ha...

Linux Distros Unpatched Vulnerability : CVE-2026-98501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: alps: fix use-after-free on input2 registration failure alpsinputconfigured stores data-input2 before calling inputregisterdevice. If registration fails,...

Linux Distros Unpatched Vulnerability : CVE-2026-98445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrepnewbtaddblocks results in online repair...

UBUNTU-CVE-2026-98610

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

UBUNTU-CVE-2026-98499

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacomwacpenserialenforce The 'wacomwacpenserialenforce' function may calculate and pass an invalid offset to hidfieldextract, resulting in memory reads at incorrect addresses -- possibly beyond the end...

UBUNTU-CVE-2026-98673

In the Linux kernel, the following vulnerability has been resolved: iio: adc: pac1934: check ACPI label duplication A label duplication failure currently reaches the terminating-byte write. Release the ACPI result and abort before accessing the missing label; earlier labels are managed by devres...

UBUNTU-CVE-2026-98467

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

UBUNTU-CVE-2026-98468

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

UBUNTU-CVE-2026-98487

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

UBUNTU-CVE-2026-98842

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetagloadmodule If codetagloadmodule fails, err is not set to reflect the failure and loadmodule returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klpinfo...

UBUNTU-CVE-2026-98845

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

UBUNTU-CVE-2026-98440

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is for...

UBUNTU-CVE-2026-98638

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvmvcpuinitsve pkvmvcpuinitsve clamps only the upper bound of the host-provided svemaxvl, so an invalid vector length reaches svestatesizefromvl and the WARNON there, which is fatal ...

UBUNTU-CVE-2026-98713

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEATFGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvmcalculatetraps...

UBUNTU-CVE-2026-98728

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2getrandom When the response carries the TPM2STSESSIONS tag, tpm2getrandom skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the...

UBUNTU-CVE-2026-98729

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply vaalign to hugetlb mappings on AMD F15h getalignmask returns hugepagemaskalign for hugetlbfs, but getalignbits adds vaalign.bits regardless, so vmunmappedarea returns an address off the huge page boundary and...