UBUNTU-CVE-2026-74324

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

UBUNTU-CVE-2026-74320

In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info-ediddata isn't free if the probe functions fail or if pd-defmode ...

UBUNTU-CVE-2026-74278

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...

UBUNTU-CVE-2026-72395

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 "hwmon: pmbus/core Protect regulator operations with mutex" introduced a worker to batch regulator events over time using atomicor. The delaye...

UBUNTU-CVE-2026-74271

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

UBUNTU-CVE-2026-72318

In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parsedfsreferrals validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server. Those offsets a...

CVE-2026-72452

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intelcrtcputcolorblobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intelcrtcprepareclearedstate, which fre...

CVE-2026-72332

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctxsyncdebugbo amdxdnahwctxsyncdebugbo invokes the hardware hwctxsyncdebugbo callback while holding xdna-devlock. The callback may call amdxdnacmdsubmit, which in turn calls...

CVE-2026-72454

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

CVE-2026-72350

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtu32: reject invalid shift counts u32matchit executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during...

CVE-2026-72362

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

CVE-2026-72396

In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...

CVE-2026-72361

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hwengine: Fix double-free of managed BO in error path The error path in hwengineinit explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup action...

CVE-2026-72387

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in groupprocesstileroom If heaps is an ERRPTR, panthorheappoolput will deref an invalid pointer. Make sure we set it to NULL in that case...

CVE-2026-72364

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writeback error handling Fix the error handling in writebackiter loop. If an error occurs, writebackiter needs to be called again with error set to the error so that it can clean up iteration state. Further, the curren...

CVE-2026-72340

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

CVE-2026-72352

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hidbpfgetdata range check hidbpfgetdata returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocatedsize. The current check adds rdwrbufsize and offset before...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-74296

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

CVE-2026-72482

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptorbusy in commandioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptorbusy reference counter to pin struct gpibdescriptor across IO ioctl operation...