UBUNTU-CVE-2026-99086

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dmintegrityresume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor...

CVE-2026-99029

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5tcmatchallreplace allocates a struct sparx5mallentry for every offloaded matchall filter and adds it to sparx5-mallentries. sparx5tcmatchalldestroy removes the entry from the...

UBUNTU-CVE-2026-98979

In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount...

UBUNTU-CVE-2026-99075

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

CVE-2026-99056

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

CVE-2026-98955

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of skb-len when computing thoff skbflowdissect computes keycontrol-thoff using: keycontrol-thoff = mintu16, nhoff, skb ? skb-len : hlen; mintu16, ... casts both arguments to u16 before comparin...

UBUNTU-CVE-2026-99039

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

UBUNTU-CVE-2026-99030

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

UBUNTU-CVE-2026-99054

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

UBUNTU-CVE-2026-99022

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

UBUNTU-CVE-2026-98952

In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcpencaprecv only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcpsessionrecv then reads the 8 byte SEID that...

UBUNTU-CVE-2026-99005

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intelrpsboost reading a stale ACTIVE state and queuing rps-work, where ACTIVE may be changed via asynchronous calls triggered by wakeref...

UBUNTU-CVE-2026-99067

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

UBUNTU-CVE-2026-99069

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...

UBUNTU-CVE-2026-99003

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

UBUNTU-CVE-2026-98965

In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql-numqueued, is updated by the ICE driver when it invokes netdevtxsentqueue...

UBUNTU-CVE-2026-99079

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AFXDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx...

CVE-2026-98927

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

CVE-2026-98921

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovldomkdir debug print ovldomkdir prints the input dentry with %pd after vfsmkdir. Since commit fe497f0759e0 "VFS: change vfsmkdir to unlock on failure.", vfsmkdir calls endcreating on the input dentry on failure...

CVE-2026-98924

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...