CVE-2026-74311

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtiodevicerestore resets the device and restores the negotiated features before calling -restore. viortcfreeze intentionally leaves the existing virtqueues in place so the...

CVE-2026-74303

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74379

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74400

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-72468

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

CVE-2026-72485

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-74425

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

CVE-2026-74259

In the Linux kernel, the following vulnerability has been resolved: cifs: remove all cifs files before kill super Cifs files may be put into fileinfoputwq during umounting cifs. After umount done, cifsFileInfoputfinal is called, which cause following BUG: BUG: kernel NULL pointer dereference,...

CVE-2026-72385

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobefgraphentry fprobefgraphentry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcureadlock only. A fprobe...

CVE-2026-72403

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

UBUNTU-CVE-2026-72316

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadataopen metadataopen returns NULL when kzallocobj fails, but the caller eractr only checks ISERRmd. Since ISERRNULL returns false, the NULL pointer is treated as a valid result and lat...

UBUNTU-CVE-2026-74424

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74426

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

UBUNTU-CVE-2026-74335

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpftaskfromvpid bpftaskfromvpid looks up a task in the pid namespace of the current task, via findtaskbyvpid: findtaskbyvpidvpid findtaskbypidnsvpid, taskactivepidnscurrent findpidnsnr, ns -...

UBUNTU-CVE-2026-74266

In the Linux kernel, the following vulnerability has been resolved: net/sched: schdualpi2: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog befo...

UBUNTU-CVE-2026-72490

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

CVE-2026-72490

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

UBUNTU-CVE-2026-74435

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpcverifydata ensure rxdecbuffer alloc rxrpcrecvmsgdata calls rxrpcverifydata whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However,...

UBUNTU-CVE-2026-72453

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, and if cache operations include an exit callback, the error code from...