UBUNTU-CVE-2026-72179

In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populatecacheleaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final ofnodeputnp correctly drops the...

UBUNTU-CVE-2026-72239

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

UBUNTU-CVE-2026-72201

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

UBUNTU-CVE-2026-72191

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

UBUNTU-CVE-2026-72161

In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2checkpointinode During unmount, ocfs2journalshutdown frees the journal and sets osb-journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2evictinode - ocfs2clearinode -...

UBUNTU-CVE-2026-72091

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

UBUNTU-CVE-2026-72163

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the journal aborts during DIO completion. The crash is a general...

CVE-2026-72210

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

UBUNTU-CVE-2026-72060

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssgndogetstats64 unconditionally calls emacgetstatbyname with FW PA stat names regardless of whether the PA stats block is present on the hardware. emacgetstatbyname already guard...

UBUNTU-CVE-2026-72178

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damoncommittarget puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid...

UBUNTU-CVE-2026-72245

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1xdeviceparsedt error path After deviceinitialize, the embedded struct device in struct host1xdevice should be released through the device core with putdevice. In host1xdeviceadd, if...

UBUNTU-CVE-2026-72022

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket's membership in...

UBUNTU-CVE-2026-72275

In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

UBUNTU-CVE-2026-72069

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rtspinunlock rtspinunlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spinlock&p-lock; rcureadlock; invalidatep;...

UBUNTU-CVE-2026-72085

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

UBUNTU-CVE-2026-72053

In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAPNETADMIN in the device netns for changelink ipipchangelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

UBUNTU-CVE-2026-72078

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint...

UBUNTU-CVE-2026-72156

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero headersize OOB read in mpfopsparseheader mpfopsparseheader reads headersize from the bitstream at MPFHEADERSIZEOFFSET 24. When headersize is zero, the expression buf + headersize - 1 reads one byte...

UBUNTU-CVE-2026-72242

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sksocket dereference in selinuxsctpbindconnect selinuxsctpbindconnect dereferences sk-sksocket to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is invoked from the...

UBUNTU-CVE-2026-72019

In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsecencrypt macsecencrypt reads the Ethernet header via ethhdrskb skb-head + skb-macheader to memmove the 12 source/destination MAC bytes forward and make room for the SecTAG. On the...