UBUNTU-CVE-2026-98962

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfsuringreadextent fails After btrfsuringreadextent, the caller always jumped to outacct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure,...

UBUNTU-CVE-2026-99046

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...

UBUNTU-CVE-2026-99049

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and xgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

UBUNTU-CVE-2026-98946

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...

CVE-2026-98946

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...

UBUNTU-CVE-2026-99001

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

CVE-2026-98932

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

CVE-2026-98923

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremapprot Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremapprot through genericaccessphys: WARNING:...

CVE-2026-98917

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREADSIZEORDER to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vt...

CVE-2026-99022

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

UBUNTU-CVE-2026-99018

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

UBUNTU-CVE-2026-98986

In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mntnsrelease drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotifymntnsdelete. That takes the mutex of every...

UBUNTU-CVE-2026-98968

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

UBUNTU-CVE-2026-98996

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

UBUNTU-CVE-2026-98940

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant-daidriver. When configuring a DAI with...

UBUNTU-CVE-2026-98989

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

UBUNTU-CVE-2026-99036

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same device...

CVE-2026-99013

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...

UBUNTU-CVE-2026-98985

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivotroot pathpivotroot reads the parents of newroot and of the caller's root and checks whether they are shared before it checks that either mount is in the caller's...

CVE-2026-99070

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...