UBUNTU-CVE-2026-99180

In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period genericcidhash and genericcidcompare read sb-sencoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcureadlock. The filesystems that use them, ext4, f2...

CVE-2026-99139: Linux: In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in…

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

CVE-2026-99120

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Cope with the SS bit being set in NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS...

CVE-2026-99103

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound workerpool in nodeactivatependingpwq: BUG: KASAN: slab-use-after-free in rawspintrylock+0x6d/0x120 Read of size 4 at addr...

CVE-2026-99216: Linux: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on…

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbusconnection.connstate to DISCONNECTED prior to calling vmbusdisconnect. But vmbusdisconnect calls vmbusinitiateunload, whi...

CVE-2026-99128

In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...

PT-2026-128164

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfs put super and ntfs3 kill sb drop th...

PT-2026-128139

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmc info-start mmioaddr and later used by dmc load program. Unlike the MMIO address table, the firmware...

PT-2026-128135

In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate parse uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that...

PT-2026-128165

In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kern unmount on setup failure mq init ns creates the mqueue mount with fc mount longterm, so its -mnt ns is MNT NS INTERNAL. When setting up the mqueue or ipc sysctls or msg init ns fails afterward...

CVE-2026-99147: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to…

In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drmexec object grabs a reference to the contended object, unlocks all other objects and pre-locks the contended one before...

UBUNTU-CVE-2026-99207

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayedcmdlock targetdodelayedwork takes dev-delayedcmdlock with a plain spinlock. It runs from systempercpuwq, so interrupts stay enabled while the lock is held. Every other...

PT-2026-128154

In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmt i2c probe In wmt i2c probe, i2c-clk is acquired using of clk get. If any subsequent operation fails or when the module is unloaded, the clock reference count is never decremented via clk put...

PT-2026-128143

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu gpr amdgpu debugfs gpr read drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label,...

CVE-2026-99170: Linux: In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copy_tree() leaves out…

In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copytree leaves out can't take over a lock Since commit c62a4766937e "movemount: transfer MNTLOCKED" a mount can be moved beneath a locked mount. The lock moves from the old cover to the new mount which...

UBUNTU-CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

UBUNTU-CVE-2026-99150

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

CVE-2026-99208

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...

UBUNTU-CVE-2026-99164

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...

UBUNTU-CVE-2026-99101

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfsnewattrflags resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is...