UBUNTU-CVE-2026-98236

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

UBUNTU-CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

UBUNTU-CVE-2026-98328

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

UBUNTU-CVE-2026-98344

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dmachanput dmachanget takes chan-device-ref only on the slow path: / no kref on fast path / if chan-clientcount modulegetowner; chan-clientcount++; return 0; if !trymodulegetowner return...

UBUNTU-CVE-2026-98345

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

UBUNTU-CVE-2026-98347

In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPERUP after multicast flush ipoibibdevflushlight temporarily clears IPOIBFLAGOPERUP to prevent multicast joins while ipoibmcastdevflush is running, and restores the flag afterwards if it was previously...

UBUNTU-CVE-2026-98358

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iserregmemfastreg takes the DMA key path and leaves rdmaregISERDIROUT.desc at NUL...

UBUNTU-CVE-2026-98197

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are not used as GPIO, w83791dprobe creates the w83791dgroupfanpwm45 sysfs group on the I2C client device. The probe error path removes this group...

UBUNTU-CVE-2026-98251

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98275

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Ack RX overrun interrupt correctly The RX overrun interrupt is reported in interrupt status register 4, but gmacirq acknowledges it using the RX descriptor error bit from status register 0. For GMAC0 this...

CVE-2026-98276

In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sockgettstamp sk-skflags must only be changed while holding the socket lock, because socksetflag and sockresetflag use non atomic operations setbit and clearbit. sockgettstamp is one of the last places whe...

CVE-2026-98301

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

CVE-2026-98306

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

CVE-2026-98311

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

CVE-2026-98314

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

CVE-2026-98345

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

CVE-2026-98359

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

CVE-2026-98362

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...

CVE-2026-98187

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: require a full expif record in PDRINTERFACELIST The PDRINTERFACELIST loop only checks that the record start is within the entry before reading an entire struct expif from it. A truncated trailing record makes the...

CVE-2026-98188

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54convertrev0 and p54convertrev1 read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken...