UBUNTU-CVE-2026-99167

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

UBUNTU-CVE-2026-99207

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayedcmdlock targetdodelayedwork takes dev-delayedcmdlock with a plain spinlock. It runs from systempercpuwq, so interrupts stay enabled while the lock is held. Every other...

UBUNTU-CVE-2026-99123

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtiotransportrecvpkt looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening...

UBUNTU-CVE-2026-99177

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

UBUNTU-CVE-2026-99209

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

PT-2026-128185

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores first cb, last cb and bytes sent in the skb control block and reads them back on completion to free the skb and credit BQL. ether setup leaves IFF TX...

PT-2026-128102

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source bu...

PT-2026-128154

In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmt i2c probe In wmt i2c probe, i2c-clk is acquired using of clk get. If any subsequent operation fails or when the module is unloaded, the clock reference count is never decremented via clk put...

PT-2026-128200

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed cmd lock target do delayed work takes dev-delayed cmd lock with a plain spin lock. It runs from system percpu wq, so interrupts stay enabled while the lock is held. Every oth...

PT-2026-128160

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcf action put tcf action put decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

PT-2026-128181

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 "net: stmmac: remove SGMII/RGMII/SMII interrupt handling" nothing on the RGMII path reads GMAC RGSMIIIS, so RGSMIIIS stays pending behind GMAC INT...

CVE-2026-99184

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocketremove decrements rdev-numcores for each core it removes, while findcorefordev searches slots 0 to numcores - 1. Unbinding the cores in the order they were bound...

PT-2026-128151

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ring buffer map get reader The mmap reader can warn when it catches up with a writer that is still committing events. rb get reader page returns NULL in this case, but ring buffer map get reader...

PT-2026-128094

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfs new attr flags resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is...

PT-2026-128112

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and always valid evicted lists were already handled in amdgpu vm validate. Without this, BOs that were create...

PT-2026-128148

In the Linux kernel, the following vulnerability has been resolved: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifront do response validates the rqid in a backend response against VSCSIIF MAX REQS before using it to index info-shadow, but then dereferences the entr...

PT-2026-128203

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocket probe stores the return value from rocket device init in the file-scoped rdev pointer before checking whether it is an error pointer. If rocket device init fails, rdev is lef...

CVE-2026-99104

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scxbypass claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates only...

CVE-2026-99199

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04eth: Move setting of netops to fix crash hip04macprobe calls ofphyconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit ...

CVE-2026-99195

In the Linux kernel, the following vulnerability has been resolved: net: ethoc: move setting of netops to fix crash ethocprobe calls ethocmdioprobe, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...