UBUNTU-CVE-2026-74472

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields the driver owns, but misses -state and -ublksrvpid. A device added wit...

UBUNTU-CVE-2026-74445

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DXBINDQUERY without a DX context vmwcmddxbindquery unconditionally dereferences swcontext-dxctxnode-ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with...

UBUNTU-CVE-2026-74477

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...

UBUNTU-CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74571

CVE-2026-74571 affects the Linux kernel/btrfs. The issue occurs when mounting with rescue=ibadroots on a corrupted block group tree, leading to a NULL pointer dereference in btrfs_update_global_block_rsv. The root cause is that btrfs_read_roots() may leave a root pointer NULL while its on-disk fe...

CVE-2026-74571 btrfs: skip global block reserve accounting for rescue mounts

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts BUG Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address:...

EUVD-2026-59636

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts BUG Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address:...

CVE-2026-74571

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts BUG Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address:...

CVE-2026-74571 btrfs: skip global block reserve accounting for rescue mounts

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts BUG Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address:...

EUVD-2026-59617

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devmhwmondeviceregisterwithinfo has been called. At that time, data-hwmondev is not y...

CVE-2026-74552 hwmon: (lm90) Only report alarms if driver is ready

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devmhwmondeviceregisterwithinfo has been called. At that time, data-hwmondev is not y...

CVE-2026-74552 hwmon: (lm90) Only report alarms if driver is ready

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devmhwmondeviceregisterwithinfo has been called. At that time, data-hwmondev is not y...

CVE-2026-74552

CVE-2026-74552 concerns the Linux kernel hwmon lm90 driver. Userspace can read certain sysfs attributes before the driver is fully registered, when data->hwmon_dev is still uninitialized, potentially triggering a NULL pointer dereference. The root cause is that lm90_update_device() and lm90_up...

CVE-2026-74552

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devmhwmondeviceregisterwithinfo has been called. At that time, data-hwmondev is not y...

CVE-2026-74538

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...

CVE-2026-74538

Vulnerability CVE-2026-74538 affects the Linux kernel Bluetooth ISO handling. Accessing iso_pi(sk)->conn may race with locking because lock_sock is not ensured in the ev3 portion of iso_connect_ind, and conn may be NULL if the socket transitions from LISTEN/CONNECT before locking. A fix adds p...

CVE-2026-74538 Bluetooth: ISO: lock sk in iso_connect_ind

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...

CVE-2026-74491 of/address: Fix NULL bus dereference in of_pci_range_parser_one()

In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in ofpcirangeparserone The bus matching rework made ofmatchbus return NULL for nodes with ranges/dma-ranges but no local address-cells. parserinit stored that NULL bus, and the range iterator...

CVE-2026-74491

In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in ofpcirangeparserone The bus matching rework made ofmatchbus return NULL for nodes with ranges/dma-ranges but no local address-cells. parserinit stored that NULL bus, and the range iterator...

CVE-2026-74477 uprobes: Fix NULL pointer dereference in hprobe_expire()

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...