UBUNTU-CVE-2026-98669

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: serialize buffer teardown with mode claims Buffer-mode claims hold mlock to guarantee that the device remains in buffer mode until the claim is released. Normal buffer updates take infoexistlock followed by mlock in...

UBUNTU-CVE-2026-98665

In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102probe and stays enabled for the lifetime of the device, but indiodev-activescanmask is only valid while a buffer is enabled...

UBUNTU-CVE-2026-98656

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenablework before freeing trigger iiotriggernotifydoneatomic defers -reenable into trig-reenablework on the system workqueue, and the worker dereferences the owning trigger through containerof. Nothing...

UBUNTU-CVE-2026-98808

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

UBUNTU-CVE-2026-98811

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

UBUNTU-CVE-2026-98809

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

UBUNTU-CVE-2026-98798

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in setcoalesce before first open The Rx ring priv and index are only set in bcmgenetinitrxring, which runs at open. Setting the Rx coalescing parameters on an interface that was never opened,...

UBUNTU-CVE-2026-98790

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

UBUNTU-CVE-2026-98758

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

UBUNTU-CVE-2026-98856

In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, getoptimizedkprobe stops at B when arming a new probe C at A+4. It leaves A...

UBUNTU-CVE-2026-98707

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...

UBUNTU-CVE-2026-98641

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes the exceptioncb path and never calls pushcalleeregs. That is the only...

UBUNTU-CVE-2026-98847

In the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state before requesting alarm IRQ devmrequestirq enables the interrupt before it returns, so the handler may run while probe is still initializing the device. Initialize the MMIO address and spinlock...

UBUNTU-CVE-2026-98546

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZREL0 writes to EL2 initel2fgt2 writes one mask to both HDFGRTR2EL2 and HDFGWTR2EL2. PMZREL0 is write-only, so its trap bit, nPMZREL0, exists only in HDFGWTR2EL2 and is therefore never set: a...

CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98509

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...

CVE-2026-98849

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcpnewlink creates the UDP socket before registernetdevice. If registration fails after pfcpdevinit succeeds, the core calls pfcpdevuninit, which releases the socket an...

UBUNTU-CVE-2026-98845

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

CVE-2026-98768

In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat-work while remove is tearing the queue down. Disable it first...

CVE-2026-98835

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...