CVE-2026-72098

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if neras && neras fec-roots fio-erasuresneras++ = i; This allows neras to reach roots + 1 the post-increment pushes it past roots. This...

CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

UBUNTU-CVE-2026-72044

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

UBUNTU-CVE-2026-72114

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

UBUNTU-CVE-2026-72201

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

CVE-2026-72030

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...

CVE-2026-72066

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGESIZE buffer. Use sysfsemitat ...

UBUNTU-CVE-2026-72261

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

UBUNTU-CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

UBUNTU-CVE-2026-72098

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if neras && neras fec-roots fio-erasuresneras++ = i; This allows neras to reach roots + 1 the post-increment pushes it past roots. This...

UBUNTU-CVE-2026-72030

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...

UBUNTU-CVE-2026-72227

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of numdests header Before the access to struct batadvtvlvmcasttracker's numdests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend...

UBUNTU-CVE-2026-72197

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

UBUNTU-CVE-2026-72206

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index block header more strictly Modify ntfsindexblockinconsisent to perform stricter validation of INDEXHEADER geometry in INDX blocks, and update ntfslookupinodebyname to use that function to validate INDX blocks...

CVE-2026-68479

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-68474

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...

UBUNTU-CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

UBUNTU-CVE-2026-68479

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

UBUNTU-CVE-2026-68474

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...