UBUNTU-CVE-2026-98858

In the Linux kernel, the following vulnerability has been resolved: iouring: fix taskwork add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs taskwork off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscqpush has published it. I...

UBUNTU-CVE-2026-98860

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssizet when checking hidbpfhwrequest As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to sizet when...

UBUNTU-CVE-2026-98861

In the Linux kernel, the following vulnerability has been resolved: fprobe: Use guardrcuschednotrace and check rcuiswatching unregisterfprobe and unregisterfprobeasync used by BPF kprobe-multi rely on standard RCU grace periods synchronizercu and callrcu to wait until in-flight fprobe handlers...

UBUNTU-CVE-2026-98862

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in killrules killrules removes mixed AUDITDIR and AUDITEXE rules when an audit tree is pruned. It drops entry-rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been...

UBUNTU-CVE-2026-98863

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GETNESTEDSTATEPAGES if getting said pages fails Re-pend GETNESTEDSTATEPAGES before exiting to userspace if getting the nested pages fails in the KVMRUN path. If userspace re-runs the vCPU, and vmcs02 holds valid...

UBUNTU-CVE-2026-98864

In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before reenqueueing a task ebf1ccff79c4 "schedext: Fix ops.dequeue semantics" moved the final opsstate store in scxdispatchenqueue after the DSQ unlock so that the custody update and...

UBUNTU-CVE-2026-98866

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce taskstruct-schedcachegrp to fix UAF Add a schedcachegrp pointer to taskstruct so that scheduler code can access the cache group directly via the task, without going through mm-schedcachegrp. This decouples...

UBUNTU-CVE-2026-98868

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment cachereplay, the writeback worker and the GC worker read a kset of getksetonmediasize bytes and advance the position by it. A forged keynum makes that size exceed the segment's...

CVE-2026-98500

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use canceldelayedworksync in remove oxphidremove uses canceldelayedwork for all three delayed work items. canceldelayedwork only dequeues a pending work item without waiting for a currently executing callback to...

CVE-2026-98587

In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for isoresourceauto client resource The todo member of isoresourceauto structure represents the state of the client resource and normally transitions in the following order: ISORESAUTOALLOC -...

CVE-2026-98619

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnllock for the ioctl self test An offline self test that brings the interface down and back up with netifclose / netifopen requires rtnllock for both. Since the ethtool IOCTL path became rtnl-optional for...

CVE-2026-98787

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in rhtabmaplookupanddeletebatch bpfmemcachefreercu uses thiscpuptr which requires migration to be disabled. All callers of rhtabdeleteelem disable migration except rhtabmaplookupanddeletebatc...

CVE-2026-98864

In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before reenqueueing a task ebf1ccff79c4 "schedext: Fix ops.dequeue semantics" moved the final opsstate store in scxdispatchenqueue after the DSQ unlock so that the custody update and...

CVE-2026-98866

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce taskstruct-schedcachegrp to fix UAF Add a schedcachegrp pointer to taskstruct so that scheduler code can access the cache group directly via the task, without going through mm-schedcachegrp. This decouples...

UBUNTU-CVE-2026-98492

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dmaalloccoherent leak on macballoc error paths Fix 3 leaks in macballoc error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated but...

UBUNTU-CVE-2026-98651

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...

UBUNTU-CVE-2026-98653

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccessshadowfault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. datentrywalk will not find any leaf entry and...

UBUNTU-CVE-2026-98655

In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with excludekernel=1 can be opened without kernel perf access. However, excludekernel does not suppress text-poke sideband records. Every PERFRECORDTEXTPOKE is marked...

UBUNTU-CVE-2026-98656

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenablework before freeing trigger iiotriggernotifydoneatomic defers -reenable into trig-reenablework on the system workqueue, and the worker dereferences the owning trigger through containerof. Nothing...

UBUNTU-CVE-2026-98657

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iiodevice left registered on PM setup failure pmruntimesetactive failing in probe jumps to errorunregbuffer, which only calls iiotriggeredbuffercleanup -- it does not undo the iiodeviceregister th...