UBUNTU-CVE-2026-98453

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2parsecontexts rejects malformed context data, SMB2open...

UBUNTU-CVE-2026-98521

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915gembusyioctl uses dmaresvforeachfenceunlocked to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is that th...

CVE-2026-98780

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded kobject before calling kobjectadd. If kobjectadd fails, the return value ...

UBUNTU-CVE-2026-98439

In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis...

CVE-2026-98832

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

UBUNTU-CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

UBUNTU-CVE-2026-98711

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

UBUNTU-CVE-2026-98480

In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970astartup powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's unwi...

UBUNTU-CVE-2026-98445

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrepnewbtaddblocks results in online repair leaking blocks that were previously allocated to write a new btree, but t...

UBUNTU-CVE-2026-98635

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

UBUNTU-CVE-2026-98784

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfxv60initmicrocode is not released when the GFX block is torn down, leaking the firmware resources. Add gfxv60freemicrocode and call it from gfxv60swfini t...

UBUNTU-CVE-2026-98807

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

CVE-2026-98568

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

UBUNTU-CVE-2026-98540

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

Linux Distros Unpatched Vulnerability : CVE-2026-98447

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes --...

Linux Distros Unpatched Vulnerability : CVE-2026-98446

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes...

UBUNTU-CVE-2026-98484

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: skip expired catchall elements on insert and delete nftsetelemcatchallinsert looks up duplicates with nftsetelemactive only, while nftsetcatchalllookup and the dump path additionally skip expired elements. On...

Linux Distros Unpatched Vulnerability : CVE-2026-98441

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: actct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again...

UBUNTU-CVE-2026-98497

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5eipsecpolicymask builds the corresponding masks independently, but setupfteaddr6 installs each mask in...

CVE-2026-98460

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi...