CVE-2026-99056

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

CVE-2026-98972

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

CVE-2026-98957

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netifnapidellocked and in pagepooldisabledirectrecycling because the driver does not disable the napi...

CVE-2026-99087

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SBFLAGDIRTYBITMAP flag set and the user activates the device in the 'R' mode, a crash in dmintegrityresume happens because th...

CVE-2026-99066

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99021

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in ofregulatorbulkgetall ofregulatorbulkgetall returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name se...

CVE-2026-98999

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

CVE-2026-98976

In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attachrecursivemnt transfers MNTLOCKED from the top mount to the mount that is moved beneath it with MOVEMOUNTBENEATH. This allows the owner of a user...

CVE-2026-98956

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiodsetvalue emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in process...

CVE-2026-98996

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

UBUNTU-CVE-2026-99042

In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...

UBUNTU-CVE-2026-98974

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFSIOCEXCHANGERANGE's TOEOF flag. The bug tricks exchange-range into modifying a file so that it has...

UBUNTU-CVE-2026-98976

In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attachrecursivemnt transfers MNTLOCKED from the top mount to the mount that is moved beneath it with MOVEMOUNTBENEATH. This allows the owner of a user...

UBUNTU-CVE-2026-98988

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPENTREENAMESPACE opentreeOPENTREENAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

UBUNTU-CVE-2026-99029

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5tcmatchallreplace allocates a struct sparx5mallentry for every offloaded matchall filter and adds it to sparx5-mallentries. sparx5tcmatchalldestroy removes the entry from the...

UBUNTU-CVE-2026-99017

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCVALTERNATIVEEARLY for THEAD GHOSTWRITE errataprobeghostwrite only marks the CPU as vulnerable when it is called at the RISCVALTERNATIVESEARLYBOOT stage, and the mitigation in ghostwriteenablemitigation...

CVE-2026-98978

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

UBUNTU-CVE-2026-99023

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

CVE-2026-98982

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount dallocpseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree frees them right aw...

CVE-2026-98940

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant-daidriver. When configuring a DAI with...