CVE-2026-99140

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARNONONCE!nest warning: WARNING: kernel/trace/ringbuffer.c:821 at ringbuffereventtimestamp Call trace: ringbuffereventtimestamp histfieldtimestamp...

CVE-2026-99173

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfsinode after an rcu grace period too tracefsdrevalidate reads -isfreed of the eventfsinode that dentry-dfsdata points to, and -drevalidate is called in rcu pathwalk mode with nothing but rcureadlock held...

CVE-2026-99148: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

PT-2026-128120

In the Linux kernel, the following vulnerability has been resolved: page pool: keep frag offset aligned for odd-sized requests page pool alloc frag netmem rounds the requested fragment size with size = ALIGNsize, dma get cache alignment; dma get cache alignment returns 1 unless the architecture...

CVE-2026-99159

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix the sub-buffer array base in rbmetasubbufidx On a persistent ring buffer, rbmetasubbufidx can return an index one sub-buffer too high. rbsetupidsmetapage then fills subbufids shifted by one and leaves subbufids0...

UBUNTU-CVE-2026-99111

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and OTRUNC cifsdotruncate flushes dirty pages with filemapwriteandwait and truncates the file on the server, but in the old code both operations ran without holding irwsem o...

CVE-2026-99129

In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry in selinuxbpftokencreate or the token...

CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

UBUNTU-CVE-2026-99211

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

CVE-2026-99175: Linux: In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector…

In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotifydestroymarks keeps a reference to its current mark while it drops conn-lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a n...

UBUNTU-CVE-2026-99184

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocketremove decrements rdev-numcores for each core it removes, while findcorefordev searches slots 0 to numcores - 1. Unbinding the cores in the order they were bound...

CVE-2026-99187: Linux: In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events…

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext leaving events behind perfpmuremove walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu, removing each one as it goes. perfremovefromcontext takes the leader out of the groups...

Linux Distros Unpatched Vulnerability : CVE-2026-99215

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: core: prevent unregistering a power supply while a callback runs Once a power supply is registered, its callbacks can immediately start firing fr...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146623)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146623 advisory. In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and...

CVE-2026-99164

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146843)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146843 advisory. In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the...

CVE-2026-99205: Linux: In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeup_preempt() for queued tasks…

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeuppreempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at...

CVE-2026-99162: Linux: In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding…

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-devid. Fix a potential UAF by duplicating the...

CVE-2026-99177

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...