UBUNTU-CVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

UBUNTU-CVE-2026-74409

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

CVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-72460

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label with fnlabelbuildinscope before the nonewprivs subset check. The build helper can fail and return NULL or an ERRPTR, but the result was...

UBUNTU-CVE-2026-72310

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

UBUNTU-CVE-2026-72428

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks checkstackwritefixedoff computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slottype with slot - i % BPFREGSIZE. The Spectre v4 sanitizati...

UBUNTU-CVE-2026-74361

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdpidx when it equals n i.e. NUMFDPC + 1...

UBUNTU-CVE-2026-72352

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hidbpfgetdata range check hidbpfgetdata returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocatedsize. The current check adds rdwrbufsize and offset before...

CVE-2026-72352

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hidbpfgetdata range check hidbpfgetdata returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocatedsize. The current check adds rdwrbufsize and offset before...

UBUNTU-CVE-2026-74341

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte halbuf without validating the response length. A response exceeding...

CVE-2026-72243

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

CVE-2026-72158

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit is se...

CVE-2026-72208

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

CVE-2026-72261

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

CVE-2026-72243

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

CVE-2026-72052

In the Linux kernel, the following vulnerability has been resolved: net: ip6gre: require CAPNETADMIN in the device netns for changelink ip6grechangelink and ip6erspanchangelink operate on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or...

UBUNTU-CVE-2026-72236

In the Linux kernel, the following vulnerability has been resolved: s390/perfcpumcf: Add missing arrayindexnospec to hwperfeventinit ev variable is userspace controlled via event-attr.config and used as an array index after bounds checking, but without speculation barriers. Add the missing...

UBUNTU-CVE-2026-72158

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit is se...

UBUNTU-CVE-2026-72061

In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAPNETADMIN in the device netns for changelink ipip6changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

UBUNTU-CVE-2026-72208

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...