UBUNTU-CVE-2026-98996

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

UBUNTU-CVE-2026-98940

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant-daidriver. When configuring a DAI with...

UBUNTU-CVE-2026-98989

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

UBUNTU-CVE-2026-99036

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same device...

CVE-2026-99013

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...

UBUNTU-CVE-2026-98985

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivotroot pathpivotroot reads the parents of newroot and of the caller's root and checks whether they are shared before it checks that either mount is in the caller's...

CVE-2026-99070

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

UBUNTU-CVE-2026-99074

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made iprtupdatepmtu update every path. For nexthop objects, fibinfonumpath and fibinfonhc...

UBUNTU-CVE-2026-98933

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

UBUNTU-CVE-2026-99071

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fibaliashwflagsset sizes t...

UBUNTU-CVE-2026-98924

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...

CVE-2026-98926

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

UBUNTU-CVE-2026-99040

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix addkey race with keyring restriction keycreateorupdate snapshots keyring-restrictlink before taking the destination keyring's semaphore. keyringrestrict installs a restriction while holding that semaphore. This allows a...

CVE-2026-99040

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix addkey race with keyring restriction keycreateorupdate snapshots keyring-restrictlink before taking the destination keyring's semaphore. keyringrestrict installs a restriction while holding that semaphore. This allows a...

UBUNTU-CVE-2026-99082

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvmmemslots...

UBUNTU-CVE-2026-98926

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

CVE-2026-98971

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

UBUNTU-CVE-2026-98991

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

UBUNTU-CVE-2026-99029

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5tcmatchallreplace allocates a struct sparx5mallentry for every offloaded matchall filter and adds it to sparx5-mallentries. sparx5tcmatchalldestroy removes the entry from the...

UBUNTU-CVE-2026-99078

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AFXDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actualwqhead is not advanced an...