CVE-2026-72423

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...

CVE-2026-72426

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup cleanfuncstate cleans dead stack slots in 4-byte halves. When the high half of a STACKSPILL slot is dead and the low half remains live, cleanup converts the live low...

CVE-2026-72383

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72375

In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular -lockwork It seems that initalising afsvnode::lockwork a single time in the slab's init function isn't sufficient for workstructs. This results in the DEBUGOBJECTS debugging...

CVE-2026-72356

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifsissueread Fix missing release of credits in the failure path in cifsissueread lest retrying the subreq just overwrites the credits value...

CVE-2026-72362

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

CVE-2026-72343

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...

CVE-2026-72296

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETHHLEN to be pullable in ifedecode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to ethtypetrans, which expects the inner...

UBUNTU-CVE-2026-74370

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luosessionretrieve Extend the scope of the rwsemread lock in luosessionretrieve to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freeing the...

UBUNTU-CVE-2026-72393

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnictxlso calls skbcowhead which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in...

UBUNTU-CVE-2026-74353

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: always resumeall after suspendall Need to restore any good queues even if the suspendall failed for some. Always run removequeue as that will schedule a GPU reset is removing the queue fails. v2: move resumeall after...

UBUNTU-CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

UBUNTU-CVE-2026-72477

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: call ntfsbadinode when failing to rename It is safe to call ntfsbadinode on live inodes since: commit 519b078998ce "fs/ntfs3: Exclude call makebadinode for live nodes." The WARNON was added when it wasn't safe by: commi...

UBUNTU-CVE-2026-72361

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hwengine: Fix double-free of managed BO in error path The error path in hwengineinit explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup action...

CVE-2026-74350

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2validateinodeblock already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatmen...

UBUNTU-CVE-2026-72329

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pcidev LUT The PF SR-IOV enable path caches VF pcidev pointers in dpiringtovfpcidevlut by iterating with pcigetdevice. Those entries do not own a reference, because the iterator drops the previous...

UBUNTU-CVE-2026-72345

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5lagcreatesinglefdb starts from i, so the failed index itself is rolled back. That can operate on uninitialized stat...

UBUNTU-CVE-2026-72433

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftmetabridge: fix NFTMETABRIIIFPVID stack leak This needs to test for nonzero retval...

UBUNTU-CVE-2026-74305

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...