UBUNTU-CVE-2026-98286

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

UBUNTU-CVE-2026-98348

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

UBUNTU-CVE-2026-98317

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

UBUNTU-CVE-2026-98276

In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sockgettstamp sk-skflags must only be changed while holding the socket lock, because socksetflag and sockresetflag use non atomic operations setbit and clearbit. sockgettstamp is one of the last places whe...

UBUNTU-CVE-2026-98253

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copytouser failure rdmajoinmulticast queues RoCE work that later reads the ucmamulticast through event-param.ud.privatedata, then listadds the CMA multicast at the head of idpriv-mclist...

UBUNTU-CVE-2026-98298

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

UBUNTU-CVE-2026-98316

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

UBUNTU-CVE-2026-98206

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into responsebuf, which is CYMAXINPUT bytes...

UBUNTU-CVE-2026-98326

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

UBUNTU-CVE-2026-98180

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...

UBUNTU-CVE-2026-98229

In the Linux kernel, the following vulnerability has been resolved: xfrm: save input state data before secpath resets xfrminput stores the current xfrmstate in the skb secpath while it continues receive-side processing. Some input paths can reset that secpath before xfrminput has finished...

UBUNTU-CVE-2026-98299

In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...

UBUNTU-CVE-2026-98261

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifschanskipordisable When a secondary channel is no longer supported by the server, cifschanskipordisable drops the channel reference with cifsputtcpsession and then continues to use the server...

UBUNTU-CVE-2026-98338

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with...

UBUNTU-CVE-2026-98327

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh-csa is allocated in ieee80211meshcsabeacon and only freed in ieee80211meshfinishcsa, i.e. when the channel switch completes. Leaving the mesh while a switch is still...

UBUNTU-CVE-2026-98217

In the Linux kernel, the following vulnerability has been resolved: IB/mlx4: Fix use-after-free on pkey sysfs registration failure registerpkeytree ignores errors from registeronepkeytree and continues registering the remaining slaves. The per-slave error path has already released the pkey parent...

UBUNTU-CVE-2026-98283

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

UBUNTU-CVE-2026-98203

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

UBUNTU-CVE-2026-98198

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

UBUNTU-CVE-2026-98342

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dmadevice dmaissuependingall walks the dmadevicelist with listforeachentryrcu under rcureadlock. dmadevicerelease unlinks the device with listdelrcu and then calls...