UBUNTU-CVE-2026-98693

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tbstop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprxwork still in flight which holds its own tunnel reference and the...

UBUNTU-CVE-2026-98694

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

UBUNTU-CVE-2026-98670

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynqunmaskwork via scheduledelayedwork; that work is cleared by a devm callback. Register the devm callback befo...

UBUNTU-CVE-2026-98689

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tbdpdprxwork checks -dprxcanceled before it takes tb-lock so it misses a tbdpdprxstop that could not cancel the already running work. It then polls the DPRX...

UBUNTU-CVE-2026-98666

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does not wait for a read ...

UBUNTU-CVE-2026-98656

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenablework before freeing trigger iiotriggernotifydoneatomic defers -reenable into trig-reenablework on the system workqueue, and the worker dereferences the owning trigger through containerof. Nothing...

UBUNTU-CVE-2026-98662

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irqwork after freeirq The threaded IRQ handler queues data-work through irqworkqueue so the trigger is polled from a per-CPU context. freeirq does not flush an irqwork the handler already queued, s...

UBUNTU-CVE-2026-98663

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16480: fix unprotected debugfs reads The firmwarerevision and firmwaredate file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does...

UBUNTU-CVE-2026-98664

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400serialnumberfops is open coded and never calls debugfsfileget, so debugfsremoverecursive does not wait for a read in progress and unbind frees the iiodev underneath it...

UBUNTU-CVE-2026-98677

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix use-after-free on unbind adsdbufferpostenable allocates sigmadelta-samplesbuf with devmkrealloc at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are...

UBUNTU-CVE-2026-98645

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwinginitff passes the driver's private data, allocated with devmkzalloc in winwingprobe, as the effect context to inputffcreatememless. The memoryless force-feedback...

UBUNTU-CVE-2026-98632

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

UBUNTU-CVE-2026-98712

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the...

UBUNTU-CVE-2026-98739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

UBUNTU-CVE-2026-98555

In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llcmachdrinit failure In llcconnacresendixxxxset0orsendrr, if llcmachdrinit fails, kfreeskbskb is called instead of kfreeskbnskb. This leaks the newly allocated nskb, reads from the freed skb via...

UBUNTU-CVE-2026-98559

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcrporterr smcrporterr traverses smclgrlist.list without holding smclgrlist.lock, allowing a concurrent smclgrterminatesched to free an lgr while it is still being dereferenced. Hold...

UBUNTU-CVE-2026-98574

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenetnetifstop and the Wake-on-LAN branch of bcmgenetsuspend both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls...

UBUNTU-CVE-2026-98562

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx-ptptxskb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WXSTATEPTPTXINPROGRESS bit prevents multiple Tx paths from submitting timesta...

UBUNTU-CVE-2026-98544

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

UBUNTU-CVE-2026-98580

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock. However, bhlocksock does not synchronise against...