CVE-2026-90256

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...

CVE-2026-90167

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pendingbreak wakes that waiter, but without serializing the...

CVE-2026-90227

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

CVE-2026-90105

In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neighreduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address similar to...

CVE-2026-90097

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition The VMBus module initialization function, hvacpiinit, currently does nothing when running in the root partition and root is not nested in another VM. But...

CVE-2026-90161

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

CVE-2026-90235

In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE xprtsock replaces and restores sk-skdataready and sk-skwritespace on live sockets with plain stores, and xsudpdosetbuffersize invokes sk-skwritespace via ...

CVE-2026-90317

In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpfspinunlock ends that protection, but the verifier leaves the pointer valid...

CVE-2026-90119

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup sndice1712probe performs multiple initialization steps after sndcardnew, but directly returns on failures from later steps without releasing the ALSA card,...

CVE-2026-90108

In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition When smcllceventhandler transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK on arrival of an ADDLINK request, it calls...

CVE-2026-90183

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, checkscalechange scales down its peers, and a peer that reaches...

CVE-2026-90111

In the Linux kernel, the following vulnerability has been resolved: ip6mr: do not clone dst in ip6mrcachereport IPv6 input attaches a non-refcounted NOREF dst to skbs under RCU. When an ingress multicast packet misses MFC lookup, ip6mrcacheunresolved places the skb onto the unresolved queue,...

CVE-2026-90086

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

UBUNTU-CVE-2026-90088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

CVE-2026-90088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

CVE-2026-90063

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...

UBUNTU-CVE-2026-90084

In the Linux kernel, the following vulnerability has been resolved: octeontx2-vf: fix workqueue and netdev race in probe/remove Initialize the VF workqueue before registernetdev so ndosetrxmode does not queue work on a NULL workqueue. Unregister the netdev before destroying the workqueue, and add...

UBUNTU-CVE-2026-90076

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fqinit computes quantum = 2 pschedmtu and initialquantum = 10 pschedmtu with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU...

UBUNTU-CVE-2026-90087

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing it against hcilookupleconnect, which returns the first LE connection ...

CVE-2026-90064

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Reject page faults from non-fault-mode scratch VMs Having scratch enabled does not make a VM capable of handling recoverable page faults. Allowing scratch VMs through the ASID lookup also admits dma-fence mode VMs. If suc...