CVE-2026-99139: Linux: In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in…

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

CVE-2026-99104

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scxbypass claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates only...

CVE-2026-99142

In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicateparse uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that...

CVE-2026-99109

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source bu...

PT-2026-128146

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.273 Description An issue exists in the libiscsi component of the Linux kernel where the iscsi handle reject function fails to properly validate the iSCSI Task Tag ITT reflected in a Reject PDU. Because the...

UBUNTU-CVE-2026-99168

In the Linux kernel, the following vulnerability has been resolved: mshvvtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage warns and leaves that CPU's regpage NULL, but initial context setup...

UBUNTU-CVE-2026-99202

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smpexecutetasksg calls pmruntimegetsync on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the getsync deadlocks: it waits for...

PT-2026-128133

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARN ON ONCE!nest warning: WARNING: kernel/trace/ring buffer.c:821 at ring buffer event time stamp Call trace: ring buffer event time stamp hist field...

PT-2026-128135

In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate parse uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that...

PT-2026-128147

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse pdu itt A transport that implements parse pdu itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if i = session-cmds max i and cmds m...

PT-2026-128162

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUT OFF MMSHARED A FUT OFF MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUT OFF INODE waiter can be...

PT-2026-128175

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch count is smaller than blob-alh cfg.device count e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = ch...

PT-2026-128183

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiod set array value complex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochip set multiple, gpiod set array value returns abruptly, bypassing the freeing of...

CVE-2026-99147: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to…

In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drmexec object grabs a reference to the contended object, unlocks all other objects and pre-locks the contended one before...

CVE-2026-99154: Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from…

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parsepduitt A transport that implements parsepduitt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if i = session-cmdsmax i and cmdsmax are...

CVE-2026-99182: Linux: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds…

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

UBUNTU-CVE-2026-99167

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

PT-2026-128105

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls flower: validate mask pointer after nla next fl set enc opt iterates the key's nested tunnel-option attributes with nla for each attr while advancing a single mask pointer via nla next at the bottom of each loop, s...

PT-2026-128110

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown br multicast disable port ctx and br multicast del port walk port-mglist with hlist for each entry safe. However, br multicast find del pg can also delete other...

PT-2026-128160

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcf action put tcf action put decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...