CVE-2026-89442

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89711

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARNONONCE from nfsdmodecheck The header for commit e75b23f9e323 "nfsd: check dcanlookup in fhverify of directories" details the assumption that justified adding the WARNONONCE to nfsdmodecheck, that assumptio...

CVE-2026-89696

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

UBUNTU-CVE-2026-89518

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix thisrq assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch may execute on a CPU different from the dispatched rq's. Several...

UBUNTU-CVE-2026-89517

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix rq-corepick corruption under core scheduling Core scheduling's picknexttask picks what to run on every SMT sibling of the core in a single pass under the shared core-wide rq lock. The selection state is consistent...

UBUNTU-CVE-2026-80963

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

UBUNTU-CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...

UBUNTU-CVE-2026-89570

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

CVE-2026-89770 iomap: don't free integrity payload that doesn't exist

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

CVE-2026-89770 iomap: don't free integrity payload that doesn't exist

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

CVE-2026-89770

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

EUVD-2026-76682

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

CVE-2026-89770

CVE-2026-89770 is a NULL pointer dereference in the Linux kernel's iomap subsystem . When PI (Protection Information) verification is disabled on a block device, fs_bio_integrity_alloc may fail to allocate a bio integrity payload. The function iomap_bio_read_folio_range_sync then calls fs_bio_int...

EUVD-2026-76673

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aavecunique null terminates at vecn - dups when VECFLAGTERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...

CVE-2026-89761

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aavecunique null terminates at vecn - dups when VECFLAGTERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...

CVE-2026-89761 apparmor: fix out-of-bounds write when null terminating a label vec

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aavecunique null terminates at vecn - dups when VECFLAGTERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...

CVE-2026-89761

CVE-2026-89761 is an out-of-bounds write in the Linux kernel's AppArmor security module. The function aa_vec_unique() writes a null terminator one entry past the end of the label vector because vec_setup() fails to reserve space for it when all label components are distinct. An unprivileged local...

CVE-2026-89734 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

CVE-2026-89734 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

EUVD-2026-76646

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...