UBUNTU-CVE-2026-99151

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocateusb4bandwidthforstream and allocateusb4bandwidth both use ASSERTstream-sink before dereferencing stream-sink-link. ASSERT is compiled out in productio...

UBUNTU-CVE-2026-99144

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...

UBUNTU-CVE-2026-99183

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler schedtocore walks rdev-cores up to rdev-numcores, and rocketremove decrements numcores for every core it removes. Unbind a core that is not the last one and the cor...

UBUNTU-CVE-2026-99190

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiodsetarrayvaluecomplex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochipsetmultiple, gpiodsetarrayvalue returns abruptly, bypassing the freeing of possibly...

UBUNTU-CVE-2026-99193

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to fix crash icssmpruethnetdevinit calls ofphygetandconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

UBUNTU-CVE-2026-99196

In the Linux kernel, the following vulnerability has been resolved: net: au1000: move setting of netops to fix crash au1000probe calls au1000miiprobe, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

UBUNTU-CVE-2026-99198

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owlemacprobe calls owlemacphyinit, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

UBUNTU-CVE-2026-99137

In the Linux kernel, the following vulnerability has been resolved: cifs: don't update isize in cifsdotruncate without a cached handle If findwritablefile returns null, cifsfileflush will return 0 without issuing setfilesize, and the outer 'if !rc' block will set isize to 0 before telling the...

UBUNTU-CVE-2026-99205

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeuppreempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at...

UBUNTU-CVE-2026-99209

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

UBUNTU-CVE-2026-99210

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocketprobe stores the return value from rocketdeviceinit in the file-scoped rdev pointer before checking whether it is an error pointer. If rocketdeviceinit fails, rdev is left as ...

UBUNTU-CVE-2026-99134

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local-assocdev local-assocdev is shared between the association path and the association-response worker without common synchronization. mac802154performassociation stores the coordinato...

UBUNTU-CVE-2026-99158

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ringbuffermapgetreader The mmap reader can warn when it catches up with a writer that is still committing events. rbgetreaderpage returns NULL in this case, but ringbuffermapgetreader treats that...

UBUNTU-CVE-2026-99160

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffermeta for CPUs without a buffer The percpu/cpuN/buffermeta files are created for every possible CPU, but buffer-bufferscpu is only allocated once that CPU comes online. Reading the file of a CPU that...

UBUNTU-CVE-2026-99159

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix the sub-buffer array base in rbmetasubbufidx On a persistent ring buffer, rbmetasubbufidx can return an index one sub-buffer too high. rbsetupidsmetapage then fills subbufids shifted by one and leaves subbufids0...

UBUNTU-CVE-2026-99162

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-devid. Fix a potential UAF by duplicating the...

UBUNTU-CVE-2026-99188

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 "net: stmmac: remove SGMII/RGMII/SMII interrupt handling" nothing on the RGMII path reads GMACRGSMIIIS, so RGSMIIIS stays pending behind GMACINTMA...

UBUNTU-CVE-2026-99197

In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xxethprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit in question, ...

UBUNTU-CVE-2026-99194

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe calls grethmdioinit, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

UBUNTU-CVE-2026-99195

In the Linux kernel, the following vulnerability has been resolved: net: ethoc: move setting of netops to fix crash ethocprobe calls ethocmdioprobe, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...