CVE-2026-89654

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in checknewmap on session freed during unlock checknewmap iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map correctly...

UBUNTU-CVE-2026-89659

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive. The client survives its stateids only because destroyclient drains...

UBUNTU-CVE-2026-89507

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...

CVE-2026-89609

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfsexorcisedaemon drops queued messages from a dying daemon without holding ecryptfsmsgctxlistsmux, but ecryptfsmsgctxalloctofree requires that lock. Take the list...

UBUNTU-CVE-2026-89609

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfsexorcisedaemon drops queued messages from a dying daemon without holding ecryptfsmsgctxlistsmux, but ecryptfsmsgctxalloctofree requires that lock. Take the list...

UBUNTU-CVE-2026-89655

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

UBUNTU-CVE-2026-89704

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89599

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicmprobe registers the display before initializing ddata-lock. Once omapdssregisterdisplay publishes the display, another consumer can reach a dsicm callba...

CVE-2026-89655

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

CVE-2026-89704

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

UBUNTU-CVE-2026-89540

In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssplock before publishing proc entry createusegssproxyprocentry publishes /proc/net/rpc/use-gss-proxy via proccreatedata before initgsspclnt runs mutexinit on sn-gssplock. Once the dentry is linked under...

UBUNTU-CVE-2026-89654

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in checknewmap on session freed during unlock checknewmap iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map correctly...

UBUNTU-CVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

UBUNTU-CVE-2026-89667

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

CVE-2026-89715

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

UBUNTU-CVE-2026-89705

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

UBUNTU-CVE-2026-80991

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravbptpinterrupt can race with ravbptpstop and pass the clock to ptpclockevent while ptpclockunregister is freeing it. This can lead to a use-after-free. Use READONCE and WRITEONCE for...

UBUNTU-CVE-2026-89519

In the Linux kernel, the following vulnerability has been resolved: schedext: Replace SCXRQBALKEEP with a dispatch verdict return SCXRQBALKEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while...

CVE-2026-81001

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in slsync slipdevs stores bare netdevice pointers and takes no reference on them. slsync and slalloc walk that table from slipopen under rtnllock, while an entry is dropped by slfreenetdev, which slsetup...

CVE-2026-80991

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravbptpinterrupt can race with ravbptpstop and pass the clock to ptpclockevent while ptpclockunregister is freeing it. This can lead to a use-after-free. Use READONCE and WRITEONCE for...