UBUNTU-CVE-2026-74288

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-72060

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssgndogetstats64 unconditionally calls emacgetstatbyname with FW PA stat names regardless of whether the PA stats block is present on the hardware. emacgetstatbyname already guard...

CVE-2026-72024

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with listdel, so an asynchronous transmit completion can...

UBUNTU-CVE-2026-72024

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with listdel, so an asynchronous transmit completion can...

UBUNTU-CVE-2026-72137

In the Linux kernel, the following vulnerability has been resolved: xfrm: natkeepalive: avoid double free on send error natkeepalivesend frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once...

CVE-2026-74367

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

CVE-2026-74333

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74288 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

CVE-2026-72433

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftmetabridge: fix NFTMETABRIIIFPVID stack leak This needs to test for nonzero retval...

CVE-2026-72409

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms Armada 370/XP/38x, mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR mvnetapercpuisr calls disablepercpuirq to mask the MPIC per-CPU...

CVE-2026-72408 geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint

In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket enabled IFLAGENEVEGROHINT gs-grohint. genevegrocomplete instead calls...

CVE-2026-72338

In the Linux kernel, the following vulnerability has been resolved: net/sched: actpedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and filling it. [email protected] reports: The clsflower...

EUVD-2026-59207

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspportlagjoin When mlxswspportlagindexget fails, mlxswspportlagjoin returns an error without releasing the lag reference obtained by the earlier mlxswsplagget. All other error paths in the functio...

CVE-2026-72283

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd-producer if updating IRTE for bypass fails Nullify irqfd-producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM'...

CVE-2026-72256

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

CVE-2026-72239

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

CVE-2026-72232

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

CVE-2026-72083

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE corescsi3emulateproregisterandmove maps the PERSISTENT RESERVE OUT parameter list with transportkmapdatasg and parses the destination TransportID with...

CVE-2026-72060 net: ethernet: ti: icssg: guard PA stat lookups

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssgndogetstats64 unconditionally calls emacgetstatbyname with FW PA stat names regardless of whether the PA stats block is present on the hardware. emacgetstatbyname already guard...