UBUNTU-CVE-2026-64515

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...

UBUNTU-CVE-2026-64224

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix double free in rvureprsrcinit rvureprsrcinit allocates queue memory before calling otx2inithwresources. When hardware resource setup fails, otx2inithwresources already unwinds the partially initialized SQ, CQ, a...

UBUNTU-CVE-2026-64524

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

UBUNTU-CVE-2026-64522

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5exfrmaddstate handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label...

UBUNTU-CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

UBUNTU-CVE-2026-64212

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwlmldremovelink, the link-fwid is saved at the beginning of the function so we have it after we freed the link. But the link pointer can be NULL, and is...

UBUNTU-CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn more about Amazon...

PT-2026-65223

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf msg push data When the scatterlist ring is full or nearly full, bpf msg push data enters a copy fallback path and computes copy + len for the page allocation size. Since len come...

PT-2026-65220

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp master redirect xdp master redirect dereferences the result of netdev master upper dev get rcu without a NULL check, but that helper returns NULL when the receiving device has no upper-maste...

PT-2026-65216

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc cdc rx handler by pinning the socket smc cdc rx handler looks up the connection by token under the link group's conns lock, drops the lock, and then dereferences conn and the smc sock derived from it, endi...

CVE-2026-64523

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

CVE-2026-64226

In the Linux kernel, the following vulnerability has been resolved: schedext: Avoid UAF in scxrootenableworkfn init failure path In scxrootenableworkfn, puttaskstructp is called before scxerror dereferences p-comm and p-pid. If the iterator's reference is the last drop, the task is freed...

CVE-2026-64234

In the Linux kernel, the following vulnerability has been resolved: tty: serial: pchuart: add check for dmaalloccoherent Add a check for dmaalloccoherent failure to prevent a potential NULL pointer dereference in dmahandlerx. Properly release DMA channels and the PCI device reference using a goto...

CVE-2026-64222

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool-stack on AQ init failure otx2poolaqinit frees pool-stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2sqaurapoolinit unwinds the partial setup...

CVE-2026-64235

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIGCALLDEPTHTRACKING enabled on an x86 retbleed-affected platform eg: Skylake, with retbleed=stuff, registering a dynamic ftrace trampoline crashes on...

CVE-2026-64237

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - validate firmware size before use Ensure that the firmware file is large enough to contain the expected number of pages and the signature which resides at the end of the firmware blob before accessing them to...

CVE-2026-64516

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access...

CVE-2026-64243

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simplemuxcontrolput rejects values greater than e-items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so valu...

CVE-2026-64526

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnlopscomplete tsconfigpreparedata calls ethnlopsbegin, we need to call ethnlopscomplete before returning the error...