Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146623)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146623 advisory. In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and...

PT-2026-128171

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apf reason.flags until kvm handle async pf reads and clear...

UBUNTU-CVE-2026-99142

In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicateparse uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that...

CVE-2026-99177

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

CVE-2026-99152: Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a…

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response iscsicompletepdu fetches the task for five response types from one place and checks only that the index resolved: case ISCSIOPLOGOUTRSP: case ISCSIOPLOGINRSP: case...

PT-2026-128166

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.161 Linux kernel versions prior to 6.11 Description A use-after-free issue exists in the tracefs eventfs revalidation process. A local user can trigger reads of freed kernel memory by racing path lookups with...

CVE-2026-99180

In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period genericcidhash and genericcidcompare read sb-sencoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcureadlock. The filesystems that use them, ext4, f2...

CVE-2026-99210: Linux: In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure…

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocketprobe stores the return value from rocketdeviceinit in the file-scoped rdev pointer before checking whether it is an error pointer. If rocketdeviceinit fails, rdev is left as ...

CVE-2026-99138

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.0. It stems from repeated lookups of the bpffs creator SID within SELinux’s BPF token permission checks; this may lead to a TOCTOU issue when users modify the token file descriptor passed to the kernel...

CVE-2026-99114: Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FSCONTROLINFORMATION smb2getinfofilesystem reports 48 bytes for FSCONTROLINFORMATION, that is the whole of struct smb2fscontrolinfo, but never assigns FileSystemControlFlags. Those four...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.19. It stems from a naming conflict wherein the loop counter idx declared in foreachinsnprefix shares the same name as a local variable in getsegregoverrideidx, causing the variable to be shadowed. This prevents termination of loops under ...

PT-2026-128095

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate lock in ntfs setattr size ntfs setattr size updates i size and resizes the on-disk attribute without holding mapping-invalidate lock. Page faults take the lock shared, so a fault racing the resize can resolv...

PT-2026-128175

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch count is smaller than blob-alh cfg.device count e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = ch...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.2. It stems from connecting to the PHY before assigning netdev-netdevops, resulting in a null pointer dereference and crash during the probe process when CONFIGNETSHAPER is enabled...

PT-2026-128179

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in get seg reg override idx Commit 45e1dccc0653 "x86/insn: Simplify for each insn prefix" made for each insn prefix declare its own loop counter named idx. get seg reg override idx keeps...

PT-2026-128134

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print graph function event tracing set tracer assigns the flags of the newly selected tracer with: tr-current trace flags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor...

PT-2026-128183

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiod set array value complex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochip set multiple, gpiod set array value returns abruptly, bypassing the freeing of...

UBUNTU-CVE-2026-99208

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...

PT-2026-128199

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi update param value, causing a double-free...