UBUNTU-CVE-2026-98954

In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in virtionethdrtoskb Commit 9e8db5913264 "net: avoid false positives in untrusted gso validation" added a '&& skb-networkheader' check before flow-dissecting GSO packets without...

UBUNTU-CVE-2026-98938

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to requestirq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

UBUNTU-CVE-2026-98947

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

CVE-2026-98945

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This...

CVE-2026-99058

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...

UBUNTU-CVE-2026-98992

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

CVE-2026-99030

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

CVE-2026-98931

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and returns success while leaving nand-ecc.engine NULL. The SPI-NAND...

CVE-2026-98973

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked listdel in drmbridgeadd When re-adding a bridge that was previously removed, drmbridgeadd drops it from bridgelingeringlist without holding bridgelock. Both bridgelist and bridgelingeringlist are protecte...

UBUNTU-CVE-2026-99076

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

CVE-2026-98990

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrinksubmounts and markmountsforexpiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided by...

CVE-2026-99003

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

CVE-2026-98992

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

CVE-2026-99069

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...

CVE-2026-99019

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices chreadconfig looks up the scsidevice of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch-dt...

CVE-2026-99079

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AFXDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx...

UBUNTU-CVE-2026-99080

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...

UBUNTU-CVE-2026-98984

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's inode locked. dolockmount takes the inode lock of the mountpoint and...

CVE-2026-98988

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPENTREENAMESPACE opentreeOPENTREENAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

UBUNTU-CVE-2026-99066

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...