PT-2026-128202

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xe evict flags switches on tbo-resource-mem type to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was fre...

UBUNTU-CVE-2026-99199

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04eth: Move setting of netops to fix crash hip04macprobe calls ofphyconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit ...

UBUNTU-CVE-2026-99194

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe calls grethmdioinit, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

CVE-2026-99203

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke -fasync before pipefasync takes pipe-mutex. Two enables of one ORDWR FIFO can therefore both enter the callback...

PT-2026-128172

In the Linux kernel, the following vulnerability has been resolved: watch queue: Fix note pool publication race in watch queue set size There is a race between watch queue set size and post one notification. watch queue set size publishes wqueue-notes, notes bitmap, nr pages and nr notes with pla...

CVE-2026-99139

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

PT-2026-128169

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling KV...

PT-2026-128179

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in get seg reg override idx Commit 45e1dccc0653 "x86/insn: Simplify for each insn prefix" made for each insn prefix declare its own loop counter named idx. get seg reg override idx keeps...

PT-2026-128162

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUT OFF MMSHARED A FUT OFF MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUT OFF INODE waiter can be...

CVE-2026-99209

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

CVE-2026-99113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FSOBJECTIDINFORMATION buffer before filling it in smb2getinfofilesystem reports 64 bytes for FSOBJECTIDINFORMATION, that is the whole of struct objectidinfo, but writes only 46 of them: - objid is 16 bytes, and wh...

PT-2026-128187

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash greth of probe calls greth mdio init, which connects the PHY, before dev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through...

UBUNTU-CVE-2026-99107

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...

UBUNTU-CVE-2026-99144

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...

UBUNTU-CVE-2026-99198

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owlemacprobe calls owlemacphyinit, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

CVE-2026-99179

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix note pool publication race in watchqueuesetsize There is a race between watchqueuesetsize and postonenotification. watchqueuesetsize publishes wqueue-notes, notesbitmap, nrpages and nrnotes with plain stores, and...

CVE-2026-99187

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext leaving events behind perfpmuremove walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu, removing each one as it goes. perfremovefromcontext takes the leader out of the groups...

CVE-2026-99109

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source bu...

CVE-2026-99142

In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicateparse uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that...

CVE-2026-99171

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...