CVE-2026-98647

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

CVE-2026-98625

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HWDEAD after worker is done flowoffloadworkdel sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remov...

UBUNTU-CVE-2026-98625

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HWDEAD after worker is done flowoffloadworkdel sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remov...

CVE-2026-98622

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

CVE-2026-98554

In the Linux kernel, the following vulnerability has been resolved: vlan: ensure sufficient headroom in vlandevhardheader Callers that only reserve ETHHLEN or less such as llcallocframe, or skbs allocated before dynamic device/headroom changes e.g. toggling VLANFLAGREORDERHDR or bonding/team...

UBUNTU-CVE-2026-98622

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

CVE-2026-98632

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

UBUNTU-CVE-2026-98629

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

CVE-2026-98504

In the Linux kernel, the following vulnerability has been resolved: PCI: ofproperty: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

CVE-2026-98519

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpudebugfstestibshow amdgpudebugfstestibshow resumes the device with pmruntimegetsync before taking the reset domain semaphore with downwritekillable. If the write lock acquisition is...

UBUNTU-CVE-2026-98519

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpudebugfstestibshow amdgpudebugfstestibshow resumes the device with pmruntimegetsync before taking the reset domain semaphore with downwritekillable. If the write lock acquisition is...

UBUNTU-CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98589

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTRTOPACKET registers' bounds are modified across subprog boundaries. PTRTOPACKET registers are actually passed as PTRTOMEM, which is assumed valid...

CVE-2026-98644

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htabmaplookupanddeletebatch htabmaplookupanddeletebatch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPFMAPLOOKUPBATCH call...

UBUNTU-CVE-2026-98644

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htabmaplookupanddeletebatch htabmaplookupanddeletebatch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPFMAPLOOKUPBATCH call...

UBUNTU-CVE-2026-98812

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

UBUNTU-CVE-2026-98504

In the Linux kernel, the following vulnerability has been resolved: PCI: ofproperty: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

UBUNTU-CVE-2026-98724

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

UBUNTU-CVE-2026-98811

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...