UBUNTU-CVE-2026-98556

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gvepreptso notes that the device requires the MSS to be len and gsosegs, never gsosize. Such a packet reaches gvetxfilltsoctxdesc, which puts gsosize into the mss field of the...

UBUNTU-CVE-2026-98459

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hcibindbis hciconnlink takes a lifetime reference to its parent with hciconnget, but only takes an operational hold on the child. hciconnunlink later balances both a hold and a reference...

UBUNTU-CVE-2026-98725

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge nvmetauthchallenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A shor...

UBUNTU-CVE-2026-98521

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915gembusyioctl uses dmaresvforeachfenceunlocked to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is that th...

CVE-2026-98780

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded kobject before calling kobjectadd. If kobjectadd fails, the return value ...

UBUNTU-CVE-2026-98439

In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis...

UBUNTU-CVE-2026-98584

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

UBUNTU-CVE-2026-98785

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...

CVE-2026-98832

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the mlx5mpeswwork function in the drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c file of the Linux kernel is related to the improper implementation of thread management. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel Distributed ARP Table Buffer Overflow DoS

The vulnerability of the batadvdatsnoopincomingdhcpack function in the net/batman-adv/distributed-arp-table.c component of the Linux kernel is related to the improper implementation of control flow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...

UBUNTU-CVE-2026-98759

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework cd321xupdatework passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartn...

UBUNTU-CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

CVE-2026-98862

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in killrules killrules removes mixed AUDITDIR and AUDITEXE rules when an audit tree is pruned. It drops entry-rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been...

UBUNTU-CVE-2026-98816

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpfjitblindinsn rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -32767...

UBUNTU-CVE-2026-98763

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both epin and epout for non-ep0 control endpoints In usbenableendpoint, non-zero control endpoints where usbendpointxfercontrol&ep-desc is true populate both dev-epinepnum and dev-epoutepnum with the same struct...

UBUNTU-CVE-2026-98447

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

UBUNTU-CVE-2026-98693

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tbstop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprxwork still in flight which holds its own tunnel reference and the...

UBUNTU-CVE-2026-98803

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than dmabufsz, the DMA scatters it across multiple RX descriptors rx Scatter-Gather. The secondary RX buffer secpage was only allocated and programmed whe...

UBUNTU-CVE-2026-98536

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...