UBUNTU-CVE-2026-98555

In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llcmachdrinit failure In llcconnacresendixxxxset0orsendrr, if llcmachdrinit fails, kfreeskbskb is called instead of kfreeskbnskb. This leaks the newly allocated nskb, reads from the freed skb via...

UBUNTU-CVE-2026-98444

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfsqmflushone fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

UBUNTU-CVE-2026-98839

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

UBUNTU-CVE-2026-98598

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

CVE-2026-98557

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gvecansendtso for UDP GSO gvecansendtso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in front of...

CVE-2026-98645

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwinginitff passes the driver's private data, allocated with devmkzalloc in winwingprobe, as the effect context to inputffcreatememless. The memoryless force-feedback...

CVE-2026-98688

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tbremovework There is a slight race between tbremovework and tbdomainremove which leads to dereferencing a NULL tb-rootswitch pointer inside tbfreeunpluggedxdomains: Thread A Thread B...

CVE-2026-98815

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...

CVE-2026-98832

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

CVE-2026-98865

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't run ops.dequeue with a DSQ lock held ops.dequeue is invoked with the source user DSQ's lock still held on the consume and move paths scxconsumedispatchq, movetaskbetweendsqs. A BPF scheduler which locks the source...

UBUNTU-CVE-2026-98472

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free haveruncpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV V...

UBUNTU-CVE-2026-98474

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpcireportstatus When pdev is non-NULL, zpcireportstatus accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the...

UBUNTU-CVE-2026-98480

In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970astartup powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's unwi...

UBUNTU-CVE-2026-98558

In the Linux kernel, the following vulnerability has been resolved: net: flush skbdefernodes in devcpudead When a CPU goes offline, devcpudead drains its softnet queues completionqueue, outputqueue, polllist, processqueue, and inputpktqueue, but leaves nethotdata.skbdefernodes untouched. If oldcp...

UBUNTU-CVE-2026-98478

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsigetinternalcmd" switched UFS internal commands to allocate requests on hba-host-pseudosdev-requestqueu...

UBUNTU-CVE-2026-98599

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stackslotobjgetspi bpfgetspi computes -off - 1 / BPFREGSIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8...

UBUNTU-CVE-2026-98603

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind-local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an...

UBUNTU-CVE-2026-98617

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue management ndos pick the napi vector for an Rx queue with: nv = fbn-napiidx % fbn-numnapi; The issue is this is only correct in the cases where there are...

UBUNTU-CVE-2026-98619

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnllock for the ioctl self test An offline self test that brings the interface down and back up with netifclose / netifopen requires rtnllock for both. Since the ethtool IOCTL path became rtnl-optional for...

UBUNTU-CVE-2026-98639

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the PageNumber and...