UBUNTU-CVE-2026-74347

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used...

UBUNTU-CVE-2026-74508

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidprecvctrlframe and hidprecvintrframe read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mo...

UBUNTU-CVE-2026-72025

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwrit...

UBUNTU-CVE-2026-74528

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

UBUNTU-CVE-2026-72420

In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid R5Overlap races while breaking stripe batches KCSAN report a race in breakstripebatchlist vs. raid5makerequest on sh-devi.flags plain word write vs. atomic bit op.. and .. one possible scenario is: CPU1 CPU2...

UBUNTU-CVE-2026-74373

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use mdclonedbio to control bio accounting instead of relying on r1bioexisted in raid1 or the ioaccounting flag in raid10. The previous logic does not reliably reflect...

UBUNTU-CVE-2026-74419

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Adjust size for copytouser The amount of data returned to user space should be limited by the buffer size provided by the application. If the buffer is smaller than the data size, return only the portion that fits...

UBUNTU-CVE-2026-72434

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

UBUNTU-CVE-2026-72481

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2csmbusreadi2cblockdataoremulated...

UBUNTU-CVE-2026-72290

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvms390giscregister registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later setup steps fails, the...

UBUNTU-CVE-2026-74399

In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evmxattrs read buffer evmreadxattrs allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlentemp to simplereadfrombuffer. When no configured xattrs are enabled, the...

UBUNTU-CVE-2026-68468

In the Linux kernel, the following vulnerability has been resolved: mtd: virt-concat: free duplicate generated name Every MTD registration runs mtdvirtconcatcreatejoin. Once a virtual concat has already been registered, the function builds the same name again and takes the equal-name branch. That...

UBUNTU-CVE-2026-72067

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

UBUNTU-CVE-2026-74296

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

UBUNTU-CVE-2026-74320

In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info-ediddata isn't free if the probe functions fail or if pd-defmode ...

UBUNTU-CVE-2026-72310

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

UBUNTU-CVE-2026-72243

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

UBUNTU-CVE-2026-74525

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

UBUNTU-CVE-2026-72283

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd-producer if updating IRTE for bypass fails Nullify irqfd-producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM'...

UBUNTU-CVE-2026-74422

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: inno-hdmi: Switch to drmmkzalloc Driver makes use of drmmencoderinit to initialize the encoder and automatically handle the cleanup by registering drmencodercleanup with drmmaddaction. However, the internal structur...