UBUNTU-CVE-2026-89612

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

UBUNTU-CVE-2026-89592

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object pointers: bos = kvmallocarrayjob-inbocount + job-outbocount, sizeofvoid ,...

CVE-2026-89557

In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb-bblogshift in super1load In super1load, sb-bblogshift is an u8 type value loaded from on- disk superblock. It is used for badblocks API badblocksset by the following sequence, 1930 rdev-badblocks.shif...

CVE-2026-89665

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

CVE-2026-89513

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-89592

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object pointers: bos = kvmallocarrayjob-inbocount + job-outbocount, sizeofvoid ,...

CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

CVE-2026-89568

In the Linux kernel, the following vulnerability has been resolved: kho: fix size calculation in khopreservedmemoryreserve khopreservedmemoryreserve calculates the size of a preservation by doing 1 order + PAGESHIFT. Since the '1' is a 32-bit integer, it can only be shifted by 31. That is, it wil...

UBUNTU-CVE-2026-89559

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...

UBUNTU-CVE-2026-89568

In the Linux kernel, the following vulnerability has been resolved: kho: fix size calculation in khopreservedmemoryreserve khopreservedmemoryreserve calculates the size of a preservation by doing 1 order + PAGESHIFT. Since the '1' is a 32-bit integer, it can only be shifted by 31. That is, it wil...

CVE-2026-89634

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlinkdata" compared the post-ALIGN length against the remaining...

CVE-2026-89559

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...

CVE-2026-89541

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

UBUNTU-CVE-2026-89634

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlinkdata" compared the post-ALIGN length against the remaining...

UBUNTU-CVE-2026-89557

In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb-bblogshift in super1load In super1load, sb-bblogshift is an u8 type value loaded from on- disk superblock. It is used for badblocks API badblocksset by the following sequence, 1930 rdev-badblocks.shif...

CVE-2026-89665 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

CVE-2026-89665

CVE-2026-89665 affects the Linux kernel's nfsd (NFS server daemon) component. The NFSv2 svcxdr_decode_sattr() function converts wire useconds to nanoseconds via tmp2 * NSEC_PER_USEC. On ILP32 (32-bit) architectures, unsigned long is 32 bits, so an out-of-range value (e.g., 4294968) wraps to a see...

EUVD-2026-76577

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

CVE-2026-89665

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

EUVD-2026-76546

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlinkdata" compared the post-ALIGN length against the remaining...