UBUNTU-CVE-2026-98998

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

CVE-2026-98987

In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attachrecursivemnt preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on top o...

CVE-2026-99050

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpiompsseirqenable arms the poll worker before publishing it: schedulework runs before the worker is added to priv-workers. If gpiompssedisconnect walks the list in that windo...

CVE-2026-98989

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-99087

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SBFLAGDIRTYBITMAP flag set and the user activates the device in the 'R' mode, a crash in dmintegrityresume happens because th...

CVE-2026-99075

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

CVE-2026-99001

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

CVE-2026-98991

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

CVE-2026-99065

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

CVE-2026-99000

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

CVE-2026-99046

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...

CVE-2026-99077

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

CVE-2026-99066

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-98969

In the Linux kernel, the following vulnerability has been resolved: net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in emtextdump", which zero-initialised the dump-side struct. Sashiko pointed at a...

CVE-2026-99054

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

CVE-2026-98934

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...

CVE-2026-99043

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

UBUNTU-CVE-2026-99063

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

CVE-2026-98953

In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlinkrel reference leak when notify work is pending devlinkrelnestedinnotifyworkschedule takes a reference on the devlinkrel for the notify work and then queues the work, ignoring the return value of...

CVE-2026-99067

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...