CVE-2026-89651

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...

CVE-2026-80993

In the Linux kernel, the following vulnerability has been resolved: net: phylink: correctly validate returned PCS in phylinkinbandcaps In phylinkinbandcaps, the PCS returned by macselectpcs is only checked if NULL but macselectpcs can also return an error pointer. This can cause a kernel panic as...

CVE-2026-89550

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

CVE-2026-89632

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

UBUNTU-CVE-2026-89560

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

UBUNTU-CVE-2026-89630

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

UBUNTU-CVE-2026-89566

In the Linux kernel, the following vulnerability has been resolved: jbd2: check needresched when skipping busy checkpoint buffers journalshrinkonecplist skips busy checkpoint buffers when called with JBD2SHRINKBUSYSKIP. The continue statement on this path also skips the needresched check at the e...

CVE-2026-89649

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

UBUNTU-CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

UBUNTU-CVE-2026-89634

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlinkdata" compared the post-ALIGN length against the remaining...

UBUNTU-CVE-2026-89632

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89766 pidfd: hold exec_update_lock around namespace ioctl

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

EUVD-2026-76678

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89766

This Linux kernel vulnerability affects the PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl(), which perform a ptrace credentials check before handing out a namespace file descriptor. Unlike the equivalent procfs paths (proc_ns_get_link, proc_ns_readlink), the pidfd path did not hold the target task'...

CVE-2026-89745 debugfs: Fix lockdown check for mmap_prepare

In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmapprepare Commit 651fdda8406d "relay: update relay to use mmapprepare" changed the mmap file operation to mmapprepare for relayfs, but the lockdown check in debugfs was not updated accordingly...

CVE-2026-89745 debugfs: Fix lockdown check for mmap_prepare

In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmapprepare Commit 651fdda8406d "relay: update relay to use mmapprepare" changed the mmap file operation to mmapprepare for relayfs, but the lockdown check in debugfs was not updated accordingly...

CVE-2026-89745

This Linux kernel vulnerability affects the debugfs subsystem. A prior commit changed relayfs from using the mmap file operation to mmap_prepare, but the corresponding lockdown check in debugfs was not updated. As a result, when the kernel is in integrity mode , debugfs fails to lock down files t...

EUVD-2026-76632

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifssbverifysignature bounds the on-disk ubifssignode-len field before handing the signature payload to verifypkcs7signature, but the check has the wrong sign: if...