CVE-2026-99130: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: don't spin on local work the task…

In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: don't spin on local work the task can't run iouringcancelgeneric refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the next...

CVE-2026-99197: Linux: In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash…

In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xxethprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit in question, ...

UBUNTU-CVE-2026-99140

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARNONONCE!nest warning: WARNING: kernel/trace/ringbuffer.c:821 at ringbuffereventtimestamp Call trace: ringbuffereventtimestamp histfieldtimestamp...

CVE-2026-99124

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix leak of uninitialized kernel data in SCLP report While reporterrorwrite checks that the provided buffer is at least as large as the header struct, but not that it is large enough to contain the report with the lengt...

CVE-2026-99163: Linux: In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields…

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In checksynthfield, when a synthetic event field is a stacktrace field-isstack and the histogram field is not a "long" stacktrace array, validation...

CVE-2026-99113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FSOBJECTIDINFORMATION buffer before filling it in smb2getinfofilesystem reports 64 bytes for FSOBJECTIDINFORMATION, that is the whole of struct objectidinfo, but writes only 46 of them: - objid is 16 bytes, and wh...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions 3.16.50 through 3.17 and 4.13. It arises because bcmgenet fails to perform unshare on shared skb prior to writing control blocks; as a result, subsequent transmissions overwrite lastcb. This causes bytes from previously completed slots to b...

CVE-2026-99177: Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in…

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

CVE-2026-99116: Linux: In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on…

In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk-pspassoc sits past skdontcopyend, so sockcopy copies it into every socket accepted from a listener without taking a reference, while inetsockdestruct puts for every inet...

UBUNTU-CVE-2026-99108

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfstrimfs aligns the start of a free extent up to the device discard granularity, but derives the discard length by aligning the original extent length down. When the free extent start is not...

CVE-2026-99182

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.4. It arises because fibrebalance returns zero on its first iteration when concurrently modifying ignorerouteswithlinkdown, yet still detects a valid next hop on the second iteration, resulting in a division by zero...

PT-2026-128146

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.273 Description An issue exists in the libiscsi component of the Linux kernel where the iscsi handle reject function fails to properly validate the iSCSI Task Tag ITT reflected in a Reject PDU. Because the...

PT-2026-128110

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown br multicast disable port ctx and br multicast del port walk port-mglist with hlist for each entry safe. However, br multicast find del pg can also delete other...

CVE-2026-99145: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned…

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable...

CVE-2026-99205: Linux: In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeup_preempt() for queued tasks…

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeuppreempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at...

UBUNTU-CVE-2026-99153

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsihandlereject takes the ITT out of that copy to find the task to clean up: memcpy&rejectedpdu, data,...

CVE-2026-99194

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe calls grethmdioinit, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

UBUNTU-CVE-2026-99185

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fwcorehandleresponse or splittransactiontimeoutcallback may manipulate the same transaction entry in the pending transaction list. T...

UBUNTU-CVE-2026-99173

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfsinode after an rcu grace period too tracefsdrevalidate reads -isfreed of the eventfsinode that dentry-dfsdata points to, and -drevalidate is called in rcu pathwalk mode with nothing but rcureadlock held...