CVE-2026-98550

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98566

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...

CVE-2026-98561

In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfpnetipsecrx drops the XArray lock before taking a reference to the xfrmstate it found. The delete path can erase the entry and drop the last state reference in that interval. RX ca...

CVE-2026-98559

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcrporterr smcrporterr traverses smclgrlist.list without holding smclgrlist.lock, allowing a concurrent smclgrterminatesched to free an lgr while it is still being dereferenced. Hold...

CVE-2026-98640

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

UBUNTU-CVE-2026-98640

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

CVE-2026-98629

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

UBUNTU-CVE-2026-98464

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

CVE-2026-98464

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

CVE-2026-98462

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...

UBUNTU-CVE-2026-98465

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

CVE-2026-98465

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

UBUNTU-CVE-2026-98478

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsigetinternalcmd" switched UFS internal commands to allocate requests on hba-host-pseudosdev-requestqueu...

CVE-2026-98478

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsigetinternalcmd" switched UFS internal commands to allocate requests on hba-host-pseudosdev-requestqueu...

CVE-2026-98476

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccwdevicegetutilstr The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpidtochp can return NUL...

CVE-2026-98485

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trt: fix zero-address non-strict match out-of-bounds read rtmt6check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6TRTFSTMASK is requested. In the IP6TRTFSTNSTRICT path, rtmt6...

CVE-2026-98469

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix AArch32 DBGBXVR handling The consolidation of the breakpoint and watchpoint register accessors switched DBGBXVR from trapbvr to trapdbgwbreg. The latter selects backing storage with demuxwbreg, which only handles...

CVE-2026-98483

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfcgetlocalgeneralbytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfcllcpfindlocal" attempted to fix a use-after-free UAF issue by invoking nfcllcplocalputlocal after accessing local-g...

UBUNTU-CVE-2026-98443

In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlogrecoveriunlinkbucket: 1. We don't null out previp after releasing it, which can lead to UAF problems if the inodegc flush call in...

CVE-2026-98442

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport - nfctexpectinsert -...