Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the reuse of freed memory after release, and could potentially cause the kernel to crash...

UBUNTU-CVE-2026-22980

In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4endgrace Writing to v4endgrace can race with server shutdown and result in memory being accessed after it was freed - reclaimstrhashtbl in particularly. We cannot hold nfsdmutex across the nfsd4endgrac...

CVE-2026-22991 libceph: make free_choose_arg_map() resilient to partial allocation

In the Linux kernel, the following vulnerability has been resolved: libceph: make freechooseargmap resilient to partial allocation freechooseargmap may dereference a NULL pointer if its caller fails after a partial allocation. For example, in decodechooseargs, if allocation of argmap-args fails,...

CVE-2026-22989 nfsd: check that server is running in unlock_filesystem

In the Linux kernel, the following vulnerability has been resolved: nfsd: check that server is running in unlockfilesystem If we are trying to unlock the filesystem via an administrative interface and nfsd isn't running, it crashes the server. This happens currently because nfsd4revokestates acce...

CVE-2026-22988 arp: do not assume dev_hard_header() does not change skb->head

In the Linux kernel, the following vulnerability has been resolved: arp: do not assume devhardheader does not change skb-head arpcreate is the only devhardheader caller making assumption about skb-head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after...

CVE-2026-22983

The CVE-2026-22983 entry refers to a Linux kernel issue where msg_get_inq was written in the callee, risking a NULL pointer dereference. The vulnerability is described as a kernel-internal variant of msghdr where callers reinitialize the field; fixing the write is intended to improve robustness a...

UBUNTU-CVE-2025-71153

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix memory leak in getfileallinfo In getfileallinfo, if vfsgetattr fails, the function returns immediately without freeing the allocated filename, leading to a memory leak. Fix this by freeing the filename before returning...

CVE-2025-71155 KVM: s390: Fix gmap_helper_zap_one_page() again

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gmaphelperzaponepage again A few checks were missing in gmaphelperzaponepage, which can lead to memory corruption in the guest under specific circumstances. Add the missing checks...

CVE-2025-71153 ksmbd: Fix memory leak in get_file_all_info()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix memory leak in getfileallinfo In getfileallinfo, if vfsgetattr fails, the function returns immediately without freeing the allocated filename, leading to a memory leak. Fix this by freeing the filename before returning...

UBUNTU-CVE-2025-71145

In the Linux kernel, the following vulnerability has been resolved: usb: phy: isp1301: fix non-OF device reference imbalance A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301getclient helper only increases the...

CVE-2025-71150 ksmbd: Fix refcount leak when invalid session is found on session lookup

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix refcount leak when invalid session is found on session lookup When a session is found but its state is not SMB2SESSIONVALID, It indicates that no valid session was found, but it is missing to decrement the reference...

CVE-2025-71150 ksmbd: Fix refcount leak when invalid session is found on session lookup

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix refcount leak when invalid session is found on session lookup When a session is found but its state is not SMB2SESSIONVALID, It indicates that no valid session was found, but it is missing to decrement the reference...

CVE-2025-71147 KEYS: trusted: Fix a memory leak in tpm2_load_cmd

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2loadcmd 'tpm2loadcmd' allocates a tempoary blob indirectly via 'tpm2keydecode' but it is not freed in the failure paths. Address this by wrapping the blob into with a cleanup helper...

Linux cffrml_receive() Heap Buffer Overflow DoS

The vulnerability of the cffrmlreceive function in the Linux operating system is related to a numerical reduction in significance. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...

Linux ti_am33x_tsc Component System Failure Information Disclosure

The vulnerability in the drivers/input/touchscreen/tiam335xtsc.c driver for the touchscreen interface TSC of the tiam33xtsc component of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an attacker to cause a system...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-004916)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004916 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers The return value of drmatomicgetcrtcstate...

Linux kernel Spectrum MR DoS

The vulnerability of the spectrummr function in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux kernel fsl_otgremove Heap Buffer Overflow Privilege Escalation

The vulnerability of the fslotgremove function in the drivers/usb/phy/phy-fsl-usb.c module of the Linux kernel relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow an attacker to gain increased privileges...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-004832)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004832 advisory. In the Linux kernel, the following vulnerability has been resolved: drivers/md/md-bitmap: check the return value of mdbitmapgetcounter Check the return value of...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-004838)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004838 advisory. In the Linux kernel, the following vulnerability has been resolved: cxl: Fix a memory leak in an error handling path A bitmapzalloc must be balanced by a correspondi...