UBUNTU-CVE-2026-97537

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

UBUNTU-CVE-2026-98134

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

UBUNTU-CVE-2026-98086

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

UBUNTU-CVE-2026-97927

In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufsfillsuper installed sb-sroot before it loaded the cylinder group structures for a writable mount: sb-sroot = dmakerootinode; ... if !sbrdonlysb if...

CVE-2026-98134

A flaw in the Linux kernel's Berkeley Packet Filter (BPF) verifier allows it to incorrectly infer that a pointer is non-null when it can actually be null at runtime. This occurs during pointer register comparisons (e.g., rA == rB) when one pointer's type lacks the PTR_MAYBE_NULL flag but still al...

EUVD-2026-86965

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

CVE-2026-98134 bpf: check_cond_jmp_op(): properly infer if register is null

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

CVE-2026-98134 bpf: check_cond_jmp_op(): properly infer if register is null

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

EUVD-2026-86960

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

CVE-2026-98129 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

CVE-2026-98129

A NULL pointer dereference exists in the Linux kernel 's scsi: mpi3mr component. The function sas_port_alloc_num() may return NULL during a memory allocation failure, but the return value is passed to sas_port_add() without a necessary null check, triggering the dereference. Additionally, a memor...

CVE-2026-98129 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

CVE-2026-98129

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

CVE-2026-98121

The Linux kernel contains a NULL pointer dereference vulnerability in the msc313e watchdog driver. The issue occurs because msc313e_wdt_probe() fails to set the driver data for the platform device, causing dev_get_drvdata() to return NULL during msc313e_wdt_suspend() and msc313e_wdt_resume() call...

CVE-2026-98121 watchdog: msc313e: Fix NULL pointer dereference in PM callbacks

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

EUVD-2026-86952

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

CVE-2026-98121 watchdog: msc313e: Fix NULL pointer dereference in PM callbacks

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

CVE-2026-98121

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

EUVD-2026-86928

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...

CVE-2026-98098 tipc: fix NULL deref in tipc_named_node_up() on empty publication list

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...