UBUNTU-CVE-2026-74604

In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce "thermal/drivers/hwmon: Cleanup coding style a bit" that introduced a use-after-free into the error path of thermaladdhwmonsysfs by removing a...

UBUNTU-CVE-2026-74631

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

UBUNTU-CVE-2026-74615

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

UBUNTU-CVE-2026-74656

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

CVE-2026-74688

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the destination transport in chunk-transport without taking a reference. When srcoutofasocok is enabled, the HEARTBEAT ACK may remain queued o...

CVE-2026-74587

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctpasconfqueueteardown...

CVE-2026-74614

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b "vsock/virtio: add support for device suspend/resume" made the run flags transition from false to true when restore installs replacement virtqueues. The RX, TX...

CVE-2026-74652

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

CVE-2026-74586

In the Linux kernel, the following vulnerability has been resolved: sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCONF chunk have been processed, sctpsfdoasconf uses this pointer to send...

CVE-2026-74661

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix netdev use-after-free in beacon worker mac802154beaconworker reads local-beaconreq under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the...

CVE-2026-74700

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...

CVE-2026-74690

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ismdevexit A ism interrupt handler can be active in parallel with ismdevexit, accessing freed data structures. No new interrupts will be generated after unregisterieq. Drain ongoing interru...

CVE-2026-74628

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...

CVE-2026-74705

In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation skbudptunnelsegment gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb-head, the saved UDP header pointer is no longer...

UBUNTU-CVE-2026-74687

In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9wdt: prevent timer rearm during teardown at91ping rearms the watchdog timer from its callback. timerdelete neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver...

UBUNTU-CVE-2026-74586

In the Linux kernel, the following vulnerability has been resolved: sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCONF chunk have been processed, sctpsfdoasconf uses this pointer to send...

UBUNTU-CVE-2026-74705

In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation skbudptunnelsegment gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb-head, the saved UDP header pointer is no longer...

UBUNTU-CVE-2026-74606

In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfsremoverec eventfsremoverec recursively removes the child at the current loop position. After the recursive call returns, listforeachentry advances by reading list.next from the removed child...

UBUNTU-CVE-2026-74614

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b "vsock/virtio: add support for device suspend/resume" made the run flags transition from false to true when restore installs replacement virtqueues. The RX, TX...

UBUNTU-CVE-2026-74587

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctpasconfqueueteardown...