CVE-2026-99212

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdmacm destroy an id RDS still owns on route failure rdsrdmacmeventhandlercmn hands the return value of rdmaresolveroute straight back to the rdmacm on RDMACMEVENTADDRRESOLVED. A synchronous failure there -...

PT-2026-128145

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response iscsi complete pdu fetches the task for five response types from one place and checks only that the index resolved: case ISCSI OP LOGOUT RSP: case ISCSI OP LOGIN RS...

CVE-2026-99170

In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copytree leaves out can't take over a lock Since commit c62a4766937e "movemount: transfer MNTLOCKED" a mount can be moved beneath a locked mount. The lock moves from the old cover to the new mount which...

UBUNTU-CVE-2026-99133

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

UBUNTU-CVE-2026-99181

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofsnotifydaemon takes a reference to the current notification pipe under wqmutex, then drops the mutex before writing the request. The write can block while the daemon...

CVE-2026-99204

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debugstateprint walks reco.nodedata and formats their fields. The formatter holds dlm-spinlock, but the recovery...

PT-2026-128203

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocket probe stores the return value from rocket device init in the file-scoped rdev pointer before checking whether it is an error pointer. If rocket device init fails, rdev is lef...

PT-2026-128154

In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmt i2c probe In wmt i2c probe, i2c-clk is acquired using of clk get. If any subsequent operation fails or when the module is unloaded, the clock reference count is never decremented via clk put...

CVE-2026-99105

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix stall when a task enqueued with SCXENQLAST lands back on its CPU's local DSQ With SCXOPSENQLAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without...

UBUNTU-CVE-2026-99164

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...

CVE-2026-99141

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in printgraphfunctionevent tracingsettracer assigns the flags of the newly selected tracer with: tr-currenttraceflags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor default...

CVE-2026-99216: Linux: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on…

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbusconnection.connstate to DISCONNECTED prior to calling vmbusdisconnect. But vmbusdisconnect calls vmbusinitiateunload, whi...

UBUNTU-CVE-2026-99208

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...

CVE-2026-99107

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...

CVE-2026-99144: Linux: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix use-after-free of a destroyed user…

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...

CVE-2026-99181: Linux: In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced…

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofsnotifydaemon takes a reference to the current notification pipe under wqmutex, then drops the mutex before writing the request. The write can block while the daemon...

CVE-2026-99135

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integritymetadata handles a discard, it fills a buffer with DISCARDFILLER and writes it over the tags, maxblocks blocks at a time. If the kmalloc fails, the buff...

CVE-2026-99144

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...

CVE-2026-99203

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke -fasync before pipefasync takes pipe-mutex. Two enables of one ORDWR FIFO can therefore both enter the callback...

UBUNTU-CVE-2026-99199

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04eth: Move setting of netops to fix crash hip04macprobe calls ofphyconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit ...