UBUNTU-CVE-2026-98870

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

UBUNTU-CVE-2026-98903

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imxmuisr imxmushutdown imxmuxcrrmwpriv, IMXMURCR, 0, IMXMUxCRRIEnpriv-dcfg-type, cp-idx; imxmuspecificrx...

UBUNTU-CVE-2026-98909

In the Linux kernel, the following vulnerability has been resolved: net: cpswnew: unregister devlink on port registration failure cpswprobe registers devlink before registering the CPSW ports. If cpswregisterports fails, the error path only unregisters the notifiers and then releases the lower...

UBUNTU-CVE-2026-98872

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

CVE-2026-98885

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...

UBUNTU-CVE-2026-98908

In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5tcflowerpsfpsetup allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources...

UBUNTU-CVE-2026-98886

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xferread waits for the HDMI I2C transaction to reach I2CTRANSACTIONDONE, but it ignores both timeout and signal returns from waitforcompletioninterruptibletimeout. If the...

CVE-2026-98886

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xferread waits for the HDMI I2C transaction to reach I2CTRANSACTIONDONE, but it ignores both timeout and signal returns from waitforcompletioninterruptibletimeout. If the...

CVE-2026-98909

In the Linux kernel, the following vulnerability has been resolved: net: cpswnew: unregister devlink on port registration failure cpswprobe registers devlink before registering the CPSW ports. If cpswregisterports fails, the error path only unregisters the notifiers and then releases the lower...

UBUNTU-CVE-2026-98899

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock...

UBUNTU-CVE-2026-98915

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2videounregisterdevice on driver removal The driver uses vb2foprelease as its file release operation, so vb2videounregisterdevice should be used instead of videounregisterdevice during driver removal. This...

UBUNTU-CVE-2026-98884

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided maxsegs The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg to call kmallocobjs wit...

UBUNTU-CVE-2026-98896

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

UBUNTU-CVE-2026-98892

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate BASEERROREVENT payload size BASEERROREVENT carries a variable number of message reports, with the count encoded in errorstatus. The notification parser used that count without checking whether the...

CVE-2026-98891

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211rxmgmtdeauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length...

CVE-2026-98896

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

CVE-2026-98915

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2videounregisterdevice on driver removal The driver uses vb2foprelease as its file release operation, so vb2videounregisterdevice should be used instead of videounregisterdevice during driver removal. This...

UBUNTU-CVE-2026-98889

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

UBUNTU-CVE-2026-98910

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copytouser failure If kfddbgtrapenable fails while copying runtimeinfo to userspace, it had already activated the trap, set debugtrapenabled, taken an extra process reference, and opened th...

CVE-2026-98893

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...