UBUNTU-CVE-2026-90201

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix UAF in pagepoolreleasenetmemdma on xacmpxchg race This bug was discovered while testing the hns3 driver under channel reconfiguration ethtool -L / ethtool -G with iperf3 traffic on arm64. The race is...

UBUNTU-CVE-2026-90155

In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already...

UBUNTU-CVE-2026-90195

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

UBUNTU-CVE-2026-90114

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

UBUNTU-CVE-2026-90162

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2lock, mid-batch granted locks are published to connection-wide conn-locklist and file-wide fp-locklist lists immediately upon vfslockfile success, while...

UBUNTU-CVE-2026-90189

In the Linux kernel, the following vulnerability has been resolved: nullblk: register configfs subsystem after creating default devices In nullinit, configfsregistersubsystem currently runs before registerblkdev, so when nullblk is built as a module, a racing mkdir + poweron from userspace can...

UBUNTU-CVE-2026-90140

In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...

UBUNTU-CVE-2026-90239

In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: release partial allocations in isp4ifallocfwgpumem isp4ifallocfwgpumem allocates several GPU memory pools in sequence. If one of them fails, it jumps to errornomemory and returns -ENOMEM without releasing the...

CVE-2026-90149

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session...

UBUNTU-CVE-2026-90313

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

UBUNTU-CVE-2026-90344

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: disconnect on CSA to channel 0 The refactor for the CSA parsing erroneously equates channel zero and no information present, leading it to ignore a CSA on an AP that advertises a switch to that invalid channel. Th...

UBUNTU-CVE-2026-90424

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra241cmdqvinitstructures allocates VINTF0 with kzallocobj, inits it, and preallocates its logical VCMDQs. Two of its error paths leak. When tegra241cmdqvinitvintf...

UBUNTU-CVE-2026-90428

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs tegra241cmdqvprobe requests the error IRQ before it has allocated the cmdqv-vintfs array and set cmdqv-numvintfs. A CMDQV left enabled with a latched error...

CVE-2026-90399

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in macphycapsparse Currently, in ath12kwmimacphycapsparse, kzalloc sizes the macphycaps buffer as totphyid len, where len is clamped to minfirmwarelen, sizeofstruct ath12kwmimacphycapsparams. The...

CVE-2026-90293

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

UBUNTU-CVE-2026-90102

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

CVE-2026-90196

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

CVE-2026-90343

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wirelessdev is still present in the driver. cfg80211leavelocked and cfg80211stoppd already do this before invoki...

CVE-2026-90164

In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems. ksmbdprocinit tears down partial state on a procfs or percpucounter...

UBUNTU-CVE-2026-90318

In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fatscanlogstart leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fatscan. fatrebuildparent uses the directory entry to rebuild the...