UBUNTU-CVE-2026-99146

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo-startmmioaddr and later used by dmcloadprogram. Unlike the MMIO address table, the firmware loa...

UBUNTU-CVE-2026-99154

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parsepduitt A transport that implements parsepduitt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if i = session-cmdsmax i and cmdsmax are...

UBUNTU-CVE-2026-99155

In the Linux kernel, the following vulnerability has been resolved: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifrontdoresponse validates the rqid in a backend response against VSCSIIFMAXREQS before using it to index info-shadow, but then dereferences the entry to...

UBUNTU-CVE-2026-99161

In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmti2cprobe In wmti2cprobe, i2c-clk is acquired using ofclkget. If any subsequent operation fails or when the module is unloaded, the clock reference count is never decremented via clkput, leadi...

UBUNTU-CVE-2026-99163

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In checksynthfield, when a synthetic event field is a stacktrace field-isstack and the histogram field is not a "long" stacktrace array, validation...

UBUNTU-CVE-2026-99174

In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...

UBUNTU-CVE-2026-99212

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdmacm destroy an id RDS still owns on route failure rdsrdmacmeventhandlercmn hands the return value of rdmaresolveroute straight back to the rdmacm on RDMACMEVENTADDRRESOLVED. A synchronous failure there -...

UBUNTU-CVE-2026-99169

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUTOFFMMSHARED A FUTOFFMMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUTOFFINODE waiter can be requeue...

UBUNTU-CVE-2026-99135

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integritymetadata handles a discard, it fills a buffer with DISCARDFILLER and writes it over the tags, maxblocks blocks at a time. If the kmalloc fails, the buff...

UBUNTU-CVE-2026-99114

In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FSCONTROLINFORMATION smb2getinfofilesystem reports 48 bytes for FSCONTROLINFORMATION, that is the whole of struct smb2fscontrolinfo, but never assigns FileSystemControlFlags. Those four...

UBUNTU-CVE-2026-99109

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source bu...

UBUNTU-CVE-2026-99189

In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxcupdateirqchainedhandler is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that...

UBUNTU-CVE-2026-99122

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmcitransportrecvstreamcb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

UBUNTU-CVE-2026-99132

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfssyncsbbuf xfssyncsbbuf holds sb/rtsb buffer locks across a synchronous xfstranscommit, which flushes the CIL push workqueue internally. If shutdown occurs during t...

UBUNTU-CVE-2026-99116

In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk-pspassoc sits past skdontcopyend, so sockcopy copies it into every socket accepted from a listener without taking a reference, while inetsockdestruct puts for every inet...

UBUNTU-CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

UBUNTU-CVE-2026-99119

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and alwaysvalid evicted lists were already handled in amdgpuvmvalidate. Without this, BOs that were created a...

UBUNTU-CVE-2026-99120

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Cope with the SS bit being set in NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS...

UBUNTU-CVE-2026-99125

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using: perfeventthrottle -- PMU-stop Shortly later the...

UBUNTU-CVE-2026-99129

In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry in selinuxbpftokencreate or the token...