CVE-2026-72380

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

CVE-2026-72369

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

UBUNTU-CVE-2026-72310

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

UBUNTU-CVE-2026-72380

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

UBUNTU-CVE-2026-72300

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72226

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. The size can therefore...

CVE-2026-72200

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

CVE-2026-72105

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72068

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in updaterlimitcpu updaterlimitcpu converts the RLIMITCPU value to nanoseconds with u64 nsecs = rlimnew NSECPERSEC; On 32-bit kernels both rlimnew unsigned long and NSECPERSEC 1000000000L...

CVE-2026-72033

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fillfrompart fillfrompart computes the size of a directory entry in sizet but stores it in a u32. An entry length near U32MAX wraps it to a small value, bypasses the bounds check, a...

UBUNTU-CVE-2026-72068

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in updaterlimitcpu updaterlimitcpu converts the RLIMITCPU value to nanoseconds with u64 nsecs = rlimnew NSECPERSEC; On 32-bit kernels both rlimnew unsigned long and NSECPERSEC 1000000000L...

UBUNTU-CVE-2026-72200

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

CVE-2026-72105

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

UBUNTU-CVE-2026-72033

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fillfrompart fillfrompart computes the size of a directory entry in sizet but stores it in a u32. An entry length near U32MAX wraps it to a small value, bypasses the bounds check, a...

UBUNTU-CVE-2026-72105

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72226

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. The size can therefore...

UBUNTU-CVE-2026-72226

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. The size can therefore...

CVE-2026-68479

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

UBUNTU-CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-74417 drm/radeon: fix integer overflow in radeon_align_pitch()

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeonalignpitch radeonalignpitch has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned cpp' calculation can overflow signed int. ...