UBUNTU-CVE-2026-98747

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

UBUNTU-CVE-2026-98748

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

UBUNTU-CVE-2026-98749

In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100shutdown stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100shutdown...

UBUNTU-CVE-2026-98750

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

UBUNTU-CVE-2026-98753

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

UBUNTU-CVE-2026-98754

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcccleanup vcccleanup sets port-tty to NULL without holding port-lock, racing with vccevent LDC callbacks that read port-tty under port-lock and then use tty-port. This can...

UBUNTU-CVE-2026-98757

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit cdns3gadgetstart arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the...

UBUNTU-CVE-2026-98759

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework cd321xupdatework passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartn...

UBUNTU-CVE-2026-98760

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect tps6598xconnect passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartner...

UBUNTU-CVE-2026-98761

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FASTROLESWAP AMS by initiating error recovery on it. This helps in cases where some cables incorrectly signal an FRS to an...

UBUNTU-CVE-2026-98763

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both epin and epout for non-ep0 control endpoints In usbenableendpoint, non-zero control endpoints where usbendpointxfercontrol&ep-desc is true populate both dev-epinepnum and dev-epoutepnum with the same struct...

UBUNTU-CVE-2026-98764

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

UBUNTU-CVE-2026-98765

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...

UBUNTU-CVE-2026-98770

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

UBUNTU-CVE-2026-98771

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

UBUNTU-CVE-2026-98774

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

UBUNTU-CVE-2026-98776

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

UBUNTU-CVE-2026-98780

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded kobject before calling kobjectadd. If kobjectadd fails, the return value ...

UBUNTU-CVE-2026-98782

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix ovl adaptor platform device leak mtkdrmprobe creates an OVL adaptor platform device with platformdeviceregisterdata when the display pipeline requires the OVL adaptor. If a later initialization step fails, the...

UBUNTU-CVE-2026-98784

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfxv60initmicrocode is not released when the GFX block is torn down, leaking the firmware resources. Add gfxv60freemicrocode and call it from gfxv60swfini t...