UBUNTU-CVE-2026-89709

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

UBUNTU-CVE-2026-89505

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...

UBUNTU-CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...

UBUNTU-CVE-2026-89570

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

UBUNTU-CVE-2026-89518

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix thisrq assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch may execute on a CPU different from the dispatched rq's. Several...

UBUNTU-CVE-2026-89517

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix rq-corepick corruption under core scheduling Core scheduling's picknexttask picks what to run on every SMT sibling of the core in a single pass under the shared core-wide rq lock. The selection state is consistent...

UBUNTU-CVE-2026-89451

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

UBUNTU-CVE-2026-80963

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

UBUNTU-CVE-2026-80987

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbtransport: Reject oversized TX buffers ntbprocesstx handles an oversized buffer by calling txhandler with a NULL data pointer and returning success. ntbnetdev therefore neither frees the skb in its completion callback nor...

CVE-2026-89770 iomap: don't free integrity payload that doesn't exist

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

CVE-2026-89770 iomap: don't free integrity payload that doesn't exist

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

CVE-2026-89770

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

CVE-2026-89770

CVE-2026-89770 is a NULL pointer dereference in the Linux kernel's iomap subsystem . When PI (Protection Information) verification is disabled on a block device, fs_bio_integrity_alloc may fail to allocate a bio integrity payload. The function iomap_bio_read_folio_range_sync then calls fs_bio_int...

EUVD-2026-76682

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

EUVD-2026-76673

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aavecunique null terminates at vecn - dups when VECFLAGTERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...

CVE-2026-89761

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aavecunique null terminates at vecn - dups when VECFLAGTERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...

CVE-2026-89761

CVE-2026-89761 is an out-of-bounds write in the Linux kernel's AppArmor security module. The function aa_vec_unique() writes a null terminator one entry past the end of the label vector because vec_setup() fails to reserve space for it when all label components are distinct. An unprivileged local...

CVE-2026-89761 apparmor: fix out-of-bounds write when null terminating a label vec

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aavecunique null terminates at vecn - dups when VECFLAGTERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...

CVE-2026-89734 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

CVE-2026-89734 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...