UBUNTU-CVE-2026-74722

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak in btrfsdoencodedwrite Local fuzzing of 6.12.94 has found the following memory leak: Unreferenced object 0xffff888018050a80 size 64: comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump first 32 bytes: 0...

UBUNTU-CVE-2026-74596

In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattrprepare The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity enabled. In that case,...

UBUNTU-CVE-2026-74593

In the Linux kernel, the following vulnerability has been resolved: schedext: Take cgrouplock first in scxcgrouplock scxcgrouplock write-locks scxcgroupopsrwsem and then takes cgrouplock, which can deadlock through kernfs: scx enable/disable cgroup rmdir cpu.weight write ------------------...

UBUNTU-CVE-2026-74698

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5equeuestart deactivates and re-activates all channels but closes only the queue being restarted. mlx5eactivatetxqsq then unconditionally calls netdevtxresetqueue, zeroing the BQL...

UBUNTU-CVE-2026-74654

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

UBUNTU-CVE-2026-74633

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

UBUNTU-CVE-2026-74694

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

UBUNTU-CVE-2026-74664

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. That is normally fine because the...

UBUNTU-CVE-2026-74672

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire initmm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where...

UBUNTU-CVE-2026-74642

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

UBUNTU-CVE-2026-74686

In the Linux kernel, the following vulnerability has been resolved: rqspinlock: Reset tail when preserving queue on deadlock Currently, the destruction of the waiter queue is suppressed for rqspinlock in cases where a deadlock is detected. Deadlock checks happen relatively frequently on entry for...

UBUNTU-CVE-2026-74599

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against page table freeing using initmm Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on initmm is held, which fixes races between...

UBUNTU-CVE-2026-74659

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mrp: fix uninitialised bytes on the wire brmrpalloctestskb builds MRP test frames on an skb from devallocskb, which does not clear the linear data area. On the MRA ring-role branch the sub-option TLV header is append...

UBUNTU-CVE-2026-74685

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282writecurr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282writecurr / need to pass it in millivolt / u32 in =...

UBUNTU-CVE-2026-74716

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages In amdxdnainsertpages, vmflagsmod sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls...

UBUNTU-CVE-2026-74658

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent robust futex exit race some more A robust futex unlock stores 0 over the whole futex value - wiping FUTEXWAITERS - and wakes a single waiter. That wakeup is a one-shot notification: the protocol relies on its...

UBUNTU-CVE-2026-74680

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the...

UBUNTU-CVE-2026-74729

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread putfifowithdiscard acts as both producer and consumer on the kfifo: it calls kfifoskip advances out and kfifoput advances in from the IRQ handler without synchronizin...

UBUNTU-CVE-2026-74602

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rballocatecpubuffer In rballocatecpubuffer, bpage-order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGESIZE if when freed: freebufferpage...

UBUNTU-CVE-2026-74644

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migrate nid damonpamigrate and damosvamigrate isolate folios into a local list and then call damonmigratepages. When targetnid is invalid including the scheme default NUMANONODE / -1...