UBUNTU-CVE-2026-98640

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

UBUNTU-CVE-2026-98726

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

CVE-2026-98442

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport - nfctexpectinsert -...

CVE-2026-98451

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...

CVE-2026-98485

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trt: fix zero-address non-strict match out-of-bounds read rtmt6check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6TRTFSTMASK is requested. In the IP6TRTFSTNSTRICT path, rtmt6...

CVE-2026-98489

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpdcons read The hardware can report an out-of-range tpdcons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spi...

CVE-2026-98498

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix reventry reference leak in mlx5tcctsharedcounterget When the reverse entry is found but its counter is already being released, refcountincnotzero fails and the reference taken by mlx5tcctentryget is never dropped...

CVE-2026-98505

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damonhugetlbmkold damonhugetlbmkold reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the updated...

CVE-2026-98512

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

CVE-2026-98517

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

CVE-2026-98521

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915gembusyioctl uses dmaresvforeachfenceunlocked to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is that th...

CVE-2026-98528

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

CVE-2026-98531

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...

CVE-2026-98535

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

CVE-2026-98611

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

CVE-2026-98612

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

CVE-2026-98644

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htabmaplookupanddeletebatch htabmaplookupanddeletebatch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPFMAPLOOKUPBATCH call...

CVE-2026-98668

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

CVE-2026-98699

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98710

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...