UBUNTU-CVE-2026-72025

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwrit...

UBUNTU-CVE-2026-72209

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfsattrfind and ntfsexternalattrfind check that generic resident attribute values fit in their attribute records and that fixed-size resident values are large enough. For variable-length...

UBUNTU-CVE-2026-72167

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x devi...

CVE-2026-72196

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay's analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetvcn tuple, the copylcns block walks lrh-lcnsfollow further entries: t16...

CVE-2026-72240

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platformdeviceregister fails in sm501registerdevice, the embedded struct device in pdev has already been initialized by deviceinitialize, but the failure path only...

UBUNTU-CVE-2026-72183

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

UBUNTU-CVE-2026-72256

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

CVE-2026-72219

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlmfile leak when nlmdofopen fails A client can repeatedly drive nlmdofopen failures by presenting file handles that the underlying export rejects. After kzallocobj succeeds in nlmlookupfile, the freshly allocated...

CVE-2026-72275

In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

CVE-2026-72276

In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in metronomefbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

CVE-2026-72061

In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAPNETADMIN in the device netns for changelink ipip6changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

CVE-2026-72165

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

UBUNTU-CVE-2026-72033

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fillfrompart fillfrompart computes the size of a directory entry in sizet but stores it in a u32. An entry length near U32MAX wraps it to a small value, bypasses the bounds check, a...

CVE-2026-72160

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject dinodes with non-canonical imode type Patch series "ocfs2: harden inode validators against forged metadata", v2. This series adds three structural checks to OCFS2 dinode validation so malformed on-disk fields are...

UBUNTU-CVE-2026-72048

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix casctl leak on spiasync failure ca8210spitransfer allocates casctl with kzallocobjGFPATOMIC and relies entirely on the SPI completion callback ca8210spitransfercomplete to free it. The spiasync API only...

CVE-2026-72020

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd "ipvs: avoid kmemcachezalloc in ipvsconnnew" changed ipvsconnnew to allocate an ipvsconn object with kmemcachealloc. The function then initializes many fields...

CVE-2026-72225

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are unsigned, so when...

UBUNTU-CVE-2026-72127

In the Linux kernel, the following vulnerability has been resolved: netdev-genl: report NAPI thread PID in the caller's pid namespace netdevnlnapifillone reports the NAPI kthread PID in NETDEVANAPIPID using taskpidnr, which returns the PID in the initial pid namespace. NETDEVCMDNAPIGET does not...

UBUNTU-CVE-2026-72089

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

UBUNTU-CVE-2026-72027

In the Linux kernel, the following vulnerability has been resolved: mm/compaction: handle freepagesprepare properly in compactionfree freepagesprepare can fail but compactionfree does not handle the failure case. Failed pages should not be added back to cc-freepages for future use, since they can...