UBUNTU-CVE-2026-98244

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

CVE-2026-98235

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release tail references on DELACTION failure A batched RTMDELACTION request takes a temporary reference on each action before attempting any deletion. tcfactiondelete clears each processed slot and drops its...

CVE-2026-98320 netfilter: flowtable: hold reference on ct until flow is released

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ...

CVE-2026-98310 drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

CVE-2026-98244 btrfs: clear free space tree creation state on rebuild failure

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

CVE-2026-98244

The Linux kernel btrfs filesystem contains a vulnerability where the btrfs_rebuild_free_space_tree() function fails to clear the BTRFS_FS_CREATING_FREE_SPACE_TREE flag on certain error paths. Specifically, a transaction restart failure can leave this flag set on a live filesystem, which results i...

EUVD-2026-93172

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

CVE-2026-98235 net/sched: act_api: release tail references on DELACTION failure

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release tail references on DELACTION failure A batched RTMDELACTION request takes a temporary reference on each action before attempting any deletion. tcfactiondelete clears each processed slot and drops its...

EUVD-2026-93163

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release tail references on DELACTION failure A batched RTMDELACTION request takes a temporary reference on each action before attempting any deletion. tcfactiondelete clears each processed slot and drops its...

CVE-2026-98235 net/sched: act_api: release tail references on DELACTION failure

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release tail references on DELACTION failure A batched RTMDELACTION request takes a temporary reference on each action before attempting any deletion. tcfactiondelete clears each processed slot and drops its...

CVE-2026-98191

The Linux kernel contains a vulnerability in the wifi: wlcore component related to runtime power management. The function wlcore_regdomain_config() acquires a runtime PM reference before sending a regulatory-domain command. However, when wlcore_cmd_regdomain_config_locked() fails, the function qu...

CVE-2026-98191 wifi: wlcore: release runtime PM ref on regdomain config failure

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcoreregdomainconfig gets a runtime PM reference before sending the regulatory-domain command. When wlcorecmdregdomainconfiglocked fails, the function queues...

CLEANSTART-2026-AJ37436 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the trino package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...

ROS-20261006-73-0447

The vulnerability in the kernel-lt is related to the use of a name with an incorrect reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106673

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the dmaengine component where a device kref underflow occurs in the dma chan put function. The dma chan get function only increments the chan-device-ref on the slow path,...

PT-2026-106520

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the wifi wlcore component where the wlcore regdomain config function fails to release a runtime Power Management PM reference when the wlcore cmd regdomain config locked...

ROS-20261006-73-0134

The vulnerability of the ndasyncdeviceregister function in the Linux operating system’s kernel is related to a violation of the count of references to pages displayed in memory. Exploiting this vulnerability can allow an attacker to trigger a service failure...

CVE-2026-106325: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106308: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

CVE-2026-106279: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...