UBUNTU-CVE-2026-98501

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alpsinputconfigured stores data-input2 before calling inputregisterdevice. If registration fails, inputfreedevice frees the input device but data-input2 still points to...

UBUNTU-CVE-2026-98513

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

UBUNTU-CVE-2026-98515

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

UBUNTU-CVE-2026-98481

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

UBUNTU-CVE-2026-98483

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfcgetlocalgeneralbytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfcllcpfindlocal" attempted to fix a use-after-free UAF issue by invoking nfcllcplocalputlocal after accessing local-g...

UBUNTU-CVE-2026-98486

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...

UBUNTU-CVE-2026-98502

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alpsinputconfigured allocates a second input device "DualPoint Stick" with inputallocatedevice and registers it, but the alpsdriver struct has no .remove handler and...

UBUNTU-CVE-2026-98657

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iiodevice left registered on PM setup failure pmruntimesetactive failing in probe jumps to errorunregbuffer, which only calls iiotriggeredbuffercleanup -- it does not undo the iiodeviceregister th...

UBUNTU-CVE-2026-98664

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400serialnumberfops is open coded and never calls debugfsfileget, so debugfsremoverecursive does not wait for a read in progress and unbind frees the iiodev underneath it...

UBUNTU-CVE-2026-98765

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...

UBUNTU-CVE-2026-98746

In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serialprobe ofclkget returns a clock with a reference that has to be released with clkput. ma35d1serialprobe never does that, so the reference is leaked on the probe error paths a...

UBUNTU-CVE-2026-98643

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

UBUNTU-CVE-2026-98767

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When dwc3checkeventbuf reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 "usb: dwc3: gadget: check that event count does not exceed even...

UBUNTU-CVE-2026-98848

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clkhwonecelldata with countedby" annotated the hws member of 'struct clkhwonecelldata' with countedby, which informs the bounds sanitizer...

UBUNTU-CVE-2026-98447

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

UBUNTU-CVE-2026-98693

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tbstop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprxwork still in flight which holds its own tunnel reference and the...

UBUNTU-CVE-2026-98436

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting support explicitly...

UBUNTU-CVE-2026-98759

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework cd321xupdatework passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartn...

UBUNTU-CVE-2026-98560

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

CVE-2026-98627

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...