495060 matches found
UBUNTU-CVE-2026-99093
In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Booting with a boot-time function tracer and a filter, for example ftrace=function ftracefilter=pudfreepmdpage panics on 7.3-rc4 as soon as the tracer starts:...
CVE-2026-99088
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in setipv6addr When executing IPv6 address rewrite actions on IPv6 fragments, setipv6addr calls updateipv6checksum. If parseipv6hdr processes a non-first IPv6 fragment, it sets...
UBUNTU-CVE-2026-99095
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...
CVE-2026-99089
In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: i2s: enable opclk in probe to balance runtime PM The probe function puts the device into the runtime PM active state with only the "iis" bus clock enabled, but it also sets priv-opclk to the parent of the RCLKSRC m...
CVE-2026-99096
In the Linux kernel, the following vulnerability has been resolved: iouring/register: don't exempt disabled rings from task restrictions A ring created with IORINGSETUPRDISABLED is exempt from its register restrictions until it is enabled. This lets the creator register the restrictions and then...
CVE-2026-99091
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix status of pending commands flushed on power off cmdcompletersp receives a struct cmdlookup and, for a pending command that has no cmdcomplete callback, falls through to cmdstatusrspcmd, data. cmdstatusrsp rea...
UBUNTU-CVE-2026-99096
In the Linux kernel, the following vulnerability has been resolved: iouring/register: don't exempt disabled rings from task restrictions A ring created with IORINGSETUPRDISABLED is exempt from its register restrictions until it is enabled. This lets the creator register the restrictions and then...
CVE-2026-99099
A flaw in the Linux kernel involving AMD processors allows for a failure to properly clear cached entries in the Translation Lookaside Buffer (TLB) during flush operations. Specifically, the processor may fail to invalidate a TLB entry when executing an INVLPGB/TLBSYNC instruction pair. This issu...
CVE-2026-99099 x86/CPU/AMD: Fix AMD TLBI Erratum #1718
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum 1718 The processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. Detect the erratum and apply a software workaround when a microcode fix is not present...
CVE-2026-99099
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum 1718 The processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. Detect the erratum and apply a software workaround when a microcode fix is not present...
CVE-2026-99098
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dmintegritycheck and dmintegrityinlinerecheck compute the checksum of each block into an on-stack buffer of HASHMAXDIGESTSIZE bytes...
CVE-2026-99098 dm-integrity: fix buffer overflow in inline mode with large tag size
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dmintegritycheck and dmintegrityinlinerecheck compute the checksum of each block into an on-stack buffer of HASHMAXDIGESTSIZE bytes...
CVE-2026-99098 dm-integrity: fix buffer overflow in inline mode with large tag size
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dmintegritycheck and dmintegrityinlinerecheck compute the checksum of each block into an on-stack buffer of HASHMAXDIGESTSIZE bytes...
CVE-2026-99098
The Linux kernel contains a buffer overflow vulnerability in the dm-integrity component when using inline mode with a large tag size. Specifically, the functions dm_integrity_check and dm_integrity_inline_recheck use an on-stack buffer of HASH_MAX_DIGESTSIZE bytes to compute block checksums. If t...
EUVD-2026-109905
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum 1718 The processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. Detect the erratum and apply a software workaround when a microcode fix is not present...
EUVD-2026-109904
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dmintegritycheck and dmintegrityinlinerecheck compute the checksum of each block into an on-stack buffer of HASHMAXDIGESTSIZE bytes...
CVE-2026-99097
The Linux kernel contains a vulnerability in the tee_dyn_shm_alloc_helper() function. The issue arises because the function derives nr_pages from a caller-supplied size and passes it to alloc_pages_exact() without validation. When the size is 0 , nr_pages becomes 0, causing alloc_pages_exact(0) t...
CVE-2026-99097 tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in teedynshmallochelper teedynshmallochelper derives nrpages from a caller-supplied size and passes it to allocpagesexact without checking it. For size == 0 nrpages is 0, and allocpagesexac...
EUVD-2026-109902
In the Linux kernel, the following vulnerability has been resolved: iouring/register: don't exempt disabled rings from task restrictions A ring created with IORINGSETUPRDISABLED is exempt from its register restrictions until it is enabled. This lets the creator register the restrictions and then...
EUVD-2026-109903
In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in teedynshmallochelper teedynshmallochelper derives nrpages from a caller-supplied size and passes it to allocpagesexact without checking it. For size == 0 nrpages is 0, and allocpagesexac...