UBUNTU-CVE-2026-98823

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211updateassocbssentry can pass such an entry to cfg80211updateknownbss when...

UBUNTU-CVE-2026-98804

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix use-after-free in pagepoolrecycleringbulk With CONFIGPAGEPOOLSTATS=y, pagepoolrecycleringbulk updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool...

CVE-2026-98470

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvmpkvmioctlallowed WARNs when kvmgetcapforkvmioctl doesn't find the ioctl number in vmioctlcaps, and kvmarchvmioctl calls it for every number the generic code doesn...

UBUNTU-CVE-2026-98761

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FASTROLESWAP AMS by initiating error recovery on it. This helps in cases where some cables incorrectly signal an FRS to an...

UBUNTU-CVE-2026-98741

In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detectusbformat cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize...

UBUNTU-CVE-2026-98792

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

CVE-2026-98840

In the Linux kernel, the following vulnerability has been resolved: vcscreen: reload vc pointer before if ret in vcswrite to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vcscreen: reload load of struct vcdata pointer in vcswrite to avoid UAF" sits after the 'if ret' block, so the...

CVE-2026-98844

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

CVE-2026-98496

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

CVE-2026-98598

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

UBUNTU-CVE-2026-98655

In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with excludekernel=1 can be opened without kernel perf access. However, excludekernel does not suppress text-poke sideband records. Every PERFRECORDTEXTPOKE is marked...

CVE-2026-98526

In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for allocated frames llcallocframe reserves link-layer headroom using the device type. This is insufficient for stacked Ethernet devices such as VLAN devices, where vlandevhardheader pushes a VLAN...

CVE-2026-98537

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

CVE-2026-98576

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

CVE-2026-98494

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

UBUNTU-CVE-2026-98589

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTRTOPACKET registers' bounds are modified across subprog boundaries. PTRTOPACKET registers are actually passed as PTRTOMEM, which is assumed valid...

UBUNTU-CVE-2026-98487

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

CVE-2026-98591

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...

CVE-2026-98586

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

UBUNTU-CVE-2026-98491

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...