CVE-2026-64030

In the Linux kernel, the following vulnerability has been resolved: w...

UBUNTU-CVE-2026-64164

In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: fix sleep while in atomic context in btrfssyncfile The trace event btrfssyncfile is called in an atomic context all trace events are and its call to dput, which is needed due to the call to dgetparent, can...

UBUNTU-CVE-2026-64058

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsreadfolio to wait on writeback Fix netfsreadfolio to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio-private folio-private may get cleaned up by the...

CVE-2026-64162

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

CVE-2026-63879

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpuhmmrangegetpages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the comm...

CVE-2026-63864

In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visittailcallinsn Commit e40f5a6bf88a "bpf: correct stack liveness for tail calls" added visittailcallinsn but did not check its return value...

CVE-2026-63798

In the Linux kernel, the following vulnerability has been resolved: i...

CVE-2026-63889

In the Linux kernel, the following vulnerability has been resolved: scsi: scsitransportfc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport...

CVE-2026-63862

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtkpciesetupirq, the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without...

UBUNTU-CVE-2026-64086

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 include PEC byte in pmbusblockxfer read buffer adm1266pmbusblockxfer sets up the read transaction with .buf = data-readbuf, .len = ADM1266PMBUSBLOCKMAX + 2, but readbuf in struct adm1266data is declared as u8...

Important: kernel6.18

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udptunnelxmitskb CVE-2026-53070 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sockops CVE-2026-5307...

CVE-2026-64089

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative lastchangesetlen batadvpivtt::lastchangesetlen len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative...

CVE-2026-53371

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound nodedesc sysfs read with %.64s nodedesc64 in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason drivers/infiniband/core/sysfs.c:1307, since...

CVE-2026-63937

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READONCE/WRITEONCE...

CVE-2026-63958

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsiconnectorchange The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsiconnectorchange uses it to index the ucsi-connector array without checki...

CVE-2026-63809

In the Linux kernel, the following vulnerability has been resolved: b...

CVE-2026-63801

In the Linux kernel, the following vulnerability has been resolved: t...

UBUNTU-CVE-2026-63844

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v4.0.3 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 2f6afc97d259d530f4f86c7743efbc573a8da927...

UBUNTU-CVE-2026-64182

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: fix memory block reference leak in poison accounting memblknrpoisoninc and memblknrpoisonsub look up a memory block via findmemoryblockbyid, which acquires a reference to the memory block device. Both helpers...

CVE-2026-63996

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...