UBUNTU-CVE-2026-89536

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

UBUNTU-CVE-2026-89704

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89503

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ringbufferallocreadpage ringbufferallocreadpage is racy with ringbuffersubbuforderset, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still...

CVE-2026-89704

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89451

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

CVE-2026-80979

In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...

CVE-2026-89501

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpubuffer::lock when resizing a subbuf Because, ringbuffersubbuforderset can clear cpubuffer-freepage, hold cpubuffer-lock to prevent races with ringbufferallocreadpage and ringbufferfreereadpage...

CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

CVE-2026-89485

In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlminspectfile lock-drop nlmtraversefiles pins the current file with fcount++ across a mutexunlock for nlminspectfile, but nothing pins the saved next pointer. A concurrent nlmreleasefile can kfree the...

UBUNTU-CVE-2026-89451

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

UBUNTU-CVE-2026-89705

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

CVE-2026-89718

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writebackstore Patch series "zram: fix stale scan bounds after reinitialization". Both writebackstore and readblockstate derive their table scan bounds from zram-disksize before acquiring devlock...

CVE-2026-89675

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

UBUNTU-CVE-2026-89499

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

UBUNTU-CVE-2026-89609

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfsexorcisedaemon drops queued messages from a dying daemon without holding ecryptfsmsgctxlistsmux, but ecryptfsmsgctxalloctofree requires that lock. Take the list...

UBUNTU-CVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

UBUNTU-CVE-2026-80991

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravbptpinterrupt can race with ravbptpstop and pass the clock to ptpclockevent while ptpclockunregister is freeing it. This can lead to a use-after-free. Use READONCE and WRITEONCE for...

CVE-2026-89609

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfsexorcisedaemon drops queued messages from a dying daemon without holding ecryptfsmsgctxlistsmux, but ecryptfsmsgctxalloctofree requires that lock. Take the list...

UBUNTU-CVE-2026-89519

In the Linux kernel, the following vulnerability has been resolved: schedext: Replace SCXRQBALKEEP with a dispatch verdict return SCXRQBALKEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while...

UBUNTU-CVE-2026-89659

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive. The client survives its stateids only because destroyclient drains...