UBUNTU-CVE-2026-74267

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before i...

UBUNTU-CVE-2026-72498

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mrhwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it...

UBUNTU-CVE-2026-74311

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtiodevicerestore resets the device and restores the negotiated features before calling -restore. viortcfreeze intentionally leaves the existing virtqueues in place so the...

UBUNTU-CVE-2026-72395

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 "hwmon: pmbus/core Protect regulator operations with mutex" introduced a worker to batch regulator events over time using atomicor. The delaye...

UBUNTU-CVE-2026-72338

In the Linux kernel, the following vulnerability has been resolved: net/sched: actpedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and filling it. [email protected] reports: The clsflower...

UBUNTU-CVE-2026-72438

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending and barrier reference leaks on discard failures raid10makerequest acquires a writespending reference with mdwritestart before calling raid10handlediscard. Several failure paths in raid10handlediscard...

UBUNTU-CVE-2026-72467

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

UBUNTU-CVE-2026-74289

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fibinfo in fibleafnotify. syzbot reported use-after-free in nsimfib4prepareevent. 0 The problem is that the following functions call fibinfohold / refcountinc while dumping fibinfo under RCU, which is...

UBUNTU-CVE-2026-74380

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

CVE-2026-72396

In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...

UBUNTU-CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

UBUNTU-CVE-2026-74350

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2validateinodeblock already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatmen...

UBUNTU-CVE-2026-72354

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

UBUNTU-CVE-2026-72455

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 "apparmor: move check for aanull file to cover all cases" intrdouced a small bug, where pathname may pass a potentially uninitialized name ...

UBUNTU-CVE-2026-74270

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

UBUNTU-CVE-2026-72446

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns -EINVAL when no interface matches. The enable branch and the response:...

UBUNTU-CVE-2026-74363

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

UBUNTU-CVE-2026-74414

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...

CVE-2026-72419

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having nfnatregisterfn in the call chain as a cause for the offending access:...

CVE-2026-72410

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Validate NIX maximum LFs correctly NIX maximum number of LFs can be set via devlink command but that can be done before assigning any LFs to a PF/VF. The condition used to check whether any LFs are assigned is...