CVE-2026-99010

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

UBUNTU-CVE-2026-99010

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

UBUNTU-CVE-2026-98949

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vmbo handling in remap When a map overlaps part of an existing mapping, pvrvmgpuvaremap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

CVE-2026-98940

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant-daidriver. When configuring a DAI with...

UBUNTU-CVE-2026-98933

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

CVE-2026-99017

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCVALTERNATIVEEARLY for THEAD GHOSTWRITE errataprobeghostwrite only marks the CPU as vulnerable when it is called at the RISCVALTERNATIVESEARLYBOOT stage, and the mitigation in ghostwriteenablemitigation...

CVE-2026-98964

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails...

CVE-2026-99005

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intelrpsboost reading a stale ACTIVE state and queuing rps-work, where ACTIVE may be changed via asynchronous calls triggered by wakeref...

CVE-2026-99013

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...

CVE-2026-99022

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

CVE-2026-99039

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

UBUNTU-CVE-2026-98935

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

UBUNTU-CVE-2026-98940

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant-daidriver. When configuring a DAI with...

UBUNTU-CVE-2026-98936

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not g...

UBUNTU-CVE-2026-99013

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...

CVE-2026-99044

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

UBUNTU-CVE-2026-99055

In the Linux kernel, the following vulnerability has been resolved: tcp: reject netiov in zerocopy receive mapping hints After copying a readable prefix, receivefallbacktocopy asks tcpzerocopysethintforskb where page mapping can resume. If the next skb is unreadable, findnextmappablefrag passes i...

UBUNTU-CVE-2026-98985

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivotroot pathpivotroot reads the parents of newroot and of the caller's root and checks whether they are shared before it checks that either mount is in the caller's...

CVE-2026-98999

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

UBUNTU-CVE-2026-99053

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipcnodefindbyname returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node,...