UBUNTU-CVE-2026-93247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

UBUNTU-CVE-2026-93261

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Fix NULL pointer dereference in locksetclass registerlockclass can return NULL when the lock class pool is exhausted, graphlock fails, or key validation fails. However, locksetclass uses the return value directly...

UBUNTU-CVE-2026-93236

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon falls back to V4L2PIXFMTMPEG2. However, if a distro has locally...

UBUNTU-CVE-2026-93210

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

UBUNTU-CVE-2026-93212

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...

EUVD-2026-86117

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xedevcoredumpsnapshotfree, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the...

CVE-2026-97519 drm/xe: Fix null pointer dereference in devcoredump cleanup

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xedevcoredumpsnapshotfree, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the...

CVE-2026-97519

The Linux kernel contains a null pointer dereference vulnerability within the drm/xe component during devcoredump cleanup . Specifically, in xe_devcoredump_snapshot_free(), the ss->gt pointer may be NULL if a snapshot was never fully populated, leading to a crash when xe_guc_capture_put_matche...

CVE-2026-97519 drm/xe: Fix null pointer dereference in devcoredump cleanup

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xedevcoredumpsnapshotfree, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the...

CVE-2026-97516 wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Add NULL check for chip-edccath in rtwfwadaptivityresult It was recently reported that rtwfwadaptivityresult in fw.c dereferences rtwdev-chip-edccath without a NULL check. The issue is that devices with the 8821CE ch...

CVE-2026-97516

The Linux kernel 's rtw88 driver contains a vulnerability where the rtw_fw_adaptivity_result() function in fw.c dereferences rtwdev->chip->edcca_th without a NULL check . This specific issue affects devices using the 8821CE chip , as these devices do not define edcca_th in their chip inform...

EUVD-2026-86114

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Add NULL check for chip-edccath in rtwfwadaptivityresult It was recently reported that rtwfwadaptivityresult in fw.c dereferences rtwdev-chip-edccath without a NULL check. The issue is that devices with the 8821CE ch...

CVE-2026-97516 wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Add NULL check for chip-edccath in rtwfwadaptivityresult It was recently reported that rtwfwadaptivityresult in fw.c dereferences rtwdev-chip-edccath without a NULL check. The issue is that devices with the 8821CE ch...

CVE-2026-97513

The Linux kernel contains a vulnerability in the chips-media: wave5 driver. A use-after-free condition can occur if an IRQ thread acquires a spinlock between the release of m2m_ctx and the wave5_release function removing the stream instance from the active list. This results in a null pointer der...

CVE-2026-97513 media: chips-media: wave5: Release m2m_ctx after Instance Removed from List

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2mctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of...

CVE-2026-97513 media: chips-media: wave5: Release m2m_ctx after Instance Removed from List

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2mctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of...

EUVD-2026-86111

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2mctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of...

CVE-2026-97508

The Linux kernel contains a vulnerability related to the thunderbolt subsystem. The issue arises because tb->root_switch is not properly set to NULL when a domain is stopped. Fixing this ensures that tb_xdp_handle_request() correctly returns an error to the remote host while maintaining the uu...

EUVD-2026-86106

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb-rootswitch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tbxdphandlerequest return error to the remote host. However, we need to make sure we keep the uui...

CVE-2026-97506 crypto: ixp4xx - fix buffer chain unwind on allocation failure

In the Linux kernel, the following vulnerability has been resolved: crypto: ixp4xx - fix buffer chain unwind on allocation failure chainupbuffers builds a linked list of buffer descriptors for a scatterlist. If dmapoolalloc fails while constructing the list, the current code sets buf to NULL and...