CVE-2026-89454

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix IRQ domain leaks in the error paths of pldainitinterrupts pldainitinterrupts initializes IRQ domains and creates IRQ mapping but does not unwind them when later step fails. If platformgetirq or either...

CVE-2026-89444

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-89521

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle picktask releasing the rq lock Core scheduling's picknexttask breaks when a -picktask implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

UBUNTU-CVE-2026-89483

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

UBUNTU-CVE-2026-81016

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amdstbs2dinit discards the return value of several S2D SMU commands. When the SMU refuses a command e.g. "SMU cmd failed. err: 0xff" the failure is only noticed...

UBUNTU-CVE-2026-89486

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmdrcvr in ipmidestroyuser Commit 9e91f8a6c868 "ipmi:msghandler: Remove srcu for the ipmiinterfaces list" dropped the synchronizercu between unlinking the command receivers from intf-cmdrcvrs and freei...

UBUNTU-CVE-2026-89630

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

UBUNTU-CVE-2026-89558

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb "md/md-bitmap: merge mdbitmapstartsync into bitmapoperations" converted stilldegraded from int to bool, but inverted the assignment in the loop...

UBUNTU-CVE-2026-89444

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

UBUNTU-CVE-2026-89577

In the Linux kernel, the following vulnerability has been resolved: dm-io: report non-retryable errors separatedly The error codes BLKSTSNOTSUPP and BLKSTSINVAL should not cause leg failure on dm-raid1. This patch changes the interface to dm-io, so that it reports two error bitmaps - errorbits an...

UBUNTU-CVE-2026-89580

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...

CVE-2026-89462

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040getvcell and max17040getsoc ignore errors returned by regmapread. When an I2C transfer fails, the uninitialized register value is converted and reported to userspace...

CVE-2026-89710

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfslayoutprocess forget path When the server returns a new layout stateid while a valid one is still held, pnfslayoutprocess calls pnfsmarkmatchinglsegsreturn on the on-stack freeme list a...

CVE-2026-89525

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index. The val...

UBUNTU-CVE-2026-89711

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARNONONCE from nfsdmodecheck The header for commit e75b23f9e323 "nfsd: check dcanlookup in fhverify of directories" details the assumption that justified adding the WARNONONCE to nfsdmodecheck, that assumptio...

UBUNTU-CVE-2026-89693

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4acltoattr return value in nfsd4create nfsd4create stores the return value of nfsd4acltoattr in status, but the switchcreate-crtype block unconditionally overwrites it in every branch. ACL translation errors are...

UBUNTU-CVE-2026-89459

In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIYPERCPU with older binutils Commit a737737cdb9c "s390/percpu: Infrastructure for more efficient thiscpu operations" introduced MVIYPERCPU, which stringifies arguments that are already C string literals. This...

UBUNTU-CVE-2026-80992

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv-ptp.clock...

CVE-2026-81016

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amdstbs2dinit discards the return value of several S2D SMU commands. When the SMU refuses a command e.g. "SMU cmd failed. err: 0xff" the failure is only noticed...

UBUNTU-CVE-2026-81001

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in slsync slipdevs stores bare netdevice pointers and takes no reference on them. slsync and slalloc walk that table from slipopen under rtnllock, while an entry is dropped by slfreenetdev, which slsetup...