UBUNTU-CVE-2026-98872

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

UBUNTU-CVE-2026-98877

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgicv4enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gicdomain” is NULL and the...

UBUNTU-CVE-2026-98891

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211rxmgmtdeauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length...

CVE-2026-98912

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event sndseqossread checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It...

UBUNTU-CVE-2026-98883

In the Linux kernel, the following vulnerability has been resolved: serial: 8250port: recognize UPIOAU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250port.c:462 at setiofromupio+0xfc/0x124, CPU0: swapper/0/1 Unsupported...

CVE-2026-98890

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbshardstartxmit casts skb-data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The...

CVE-2026-98894

In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does...

CVE-2026-98896

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

CVE-2026-98915

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2videounregisterdevice on driver removal The driver uses vb2foprelease as its file release operation, so vb2videounregisterdevice should be used instead of videounregisterdevice during driver removal. This...

CVE-2026-98886

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xferread waits for the HDMI I2C transaction to reach I2CTRANSACTIONDONE, but it ignores both timeout and signal returns from waitforcompletioninterruptibletimeout. If the...

CVE-2026-98891

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211rxmgmtdeauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length...

CVE-2026-98902

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bmseq comparison wrap-safe Once the 32-bit seq wraps, a newer bmseq can look smaller than old, so .. covert to wrap-safe calculate way...

CVE-2026-98914

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with executedepth and return -ELOOP when exceeded...

CVE-2026-98913

In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvfprobe caviumptpget acquires a reference to the PTP PCI device through pcigetdevice. If any initialization step fails after caviumptpget, the PTP PCI device reference is leaked. Add a...

CVE-2026-98909

In the Linux kernel, the following vulnerability has been resolved: net: cpswnew: unregister devlink on port registration failure cpswprobe registers devlink before registering the CPSW ports. If cpswregisterports fails, the error path only unregisters the notifiers and then releases the lower...

CVE-2026-98907

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sbwritepointer with invalidate lock sbwritepointer reads the super block from the block device page cache using readcachepagegfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 "btrfs...

CVE-2026-98910

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copytouser failure If kfddbgtrapenable fails while copying runtimeinfo to userspace, it had already activated the trap, set debugtrapenabled, taken an extra process reference, and opened th...

CVE-2026-98893

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...

CVE-2026-98908

In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5tcflowerpsfpsetup allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources...

CVE-2026-98884

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided maxsegs The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg to call kmallocobjs wit...