CVE-2026-72340

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

CVE-2026-72352

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hidbpfgetdata range check hidbpfgetdata returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocatedsize. The current check adds rdwrbufsize and offset before...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72376

In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net-cellsoutstanding Fix net-cellsoutstanding being incremented before the check for failure of idralloccyclic, leaving the count incremented on error...

CVE-2026-74382

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...

UBUNTU-CVE-2026-74278

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...

UBUNTU-CVE-2026-72291

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in trygetlockedpte Fix an unlikely race in trygetlockedpte, which could have happened if puds or pmds get unmapped between the p?dpget and p?doffset functions...

UBUNTU-CVE-2026-72308

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspportlagjoin When mlxswspportlagindexget fails, mlxswspportlagjoin returns an error without releasing the lag reference obtained by the earlier mlxswsplagget. All other error paths in the functio...

UBUNTU-CVE-2026-72438

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending and barrier reference leaks on discard failures raid10makerequest acquires a writespending reference with mdwritestart before calling raid10handlediscard. Several failure paths in raid10handlediscard...

UBUNTU-CVE-2026-72335

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

UBUNTU-CVE-2026-74373

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use mdclonedbio to control bio accounting instead of relying on r1bioexisted in raid1 or the ioaccounting flag in raid10. The previous logic does not reliably reflect...

UBUNTU-CVE-2026-74273

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion and attachtarget, as well as the period between...

UBUNTU-CVE-2026-74425

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

UBUNTU-CVE-2026-74295

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdachdmi: Validate written enum value hdachdmisetpinportmux uses the written enum value to index the texts array before calling sndsocdapmputenumdouble, which validates that the value is within the enum item range. ...

UBUNTU-CVE-2026-72297

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATMANYCLASS in checktp. SOATMQOS stores the supplied QoS after checkqos succeeds, so accepting larger values leaves invalid...

UBUNTU-CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

UBUNTU-CVE-2026-72455

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 "apparmor: move check for aanull file to cover all cases" intrdouced a small bug, where pathname may pass a potentially uninitialized name ...

UBUNTU-CVE-2026-72467

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

UBUNTU-CVE-2026-74294

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: aiu: Validate written enum values The AIU HDMI and internal codec mux put callbacks use the written enum value with sndsocenumitemtoval before checking whether the value is valid for the enumeration. Reject...

UBUNTU-CVE-2026-74414

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...