UBUNTU-CVE-2026-99061

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

CVE-2026-99061

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

CVE-2026-98936

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not g...

CVE-2026-98935

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-99015

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hcisockbind clears hcipisk-hdev and drops the device referenc...

CVE-2026-98949

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vmbo handling in remap When a map overlaps part of an existing mapping, pvrvmgpuvaremap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

CVE-2026-99004

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

CVE-2026-99023

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

UBUNTU-CVE-2026-98960

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

CVE-2026-99060

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

CVE-2026-99072

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added an RCU-only fibnlmsgsize call for asynchronous hardware flag...

UBUNTU-CVE-2026-98939

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmapreadlock to...

UBUNTU-CVE-2026-98944

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and th...

UBUNTU-CVE-2026-99064

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

UBUNTU-CVE-2026-99031

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup brmulticastsgdelexcludeports removes automatically added STAREXCL port groups by calling brmulticastdelpg. For S,G entries, that deletion calls back into...

CVE-2026-98977

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

UBUNTU-CVE-2026-99028

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

UBUNTU-CVE-2026-99015

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hcisockbind clears hcipisk-hdev and drops the device referenc...

UBUNTU-CVE-2026-99068

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...

UBUNTU-CVE-2026-98964

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails...