CVE-2026-99048

In the Linux kernel, the following vulnerability has been resolved: gve: fix napidisable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napidisable and napienable. However, the netdev lock has already been acquired before ndobpf is calle...

CVE-2026-99002

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

CVE-2026-99080

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...

UBUNTU-CVE-2026-99051

In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverityinfo fsveritygetinfo calls rhashtablelookupfast, which just uses rcureadlock and doesn't directly synchronize with fsverityremoveinfo. For the same inode this isn't a problem: its...

CVE-2026-99016

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access accessok checks untaggedaddruaddr, but archfutexatomicopinuser and futexatomiccmpxchginatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through...

UBUNTU-CVE-2026-99044

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

UBUNTU-CVE-2026-98983

In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switchtasknamespaces and copynamespaces and dropped...

CVE-2026-99085

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in schedcpuwaitempty until nothing else is left, and the only thing that wakes it...

CVE-2026-99014

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix command skb lifetime during scan setup During PA sync scan setup, hcilesetextscanparamsync gets the address used for the PALINK lookup from hcisentcmddata. The returned pointer borrows storage from sentcmd...

CVE-2026-98922

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad...

UBUNTU-CVE-2026-98950

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

CVE-2026-99084

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

UBUNTU-CVE-2026-98938

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to requestirq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

UBUNTU-CVE-2026-98971

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

UBUNTU-CVE-2026-99014

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix command skb lifetime during scan setup During PA sync scan setup, hcilesetextscanparamsync gets the address used for the PALINK lookup from hcisentcmddata. The returned pointer borrows storage from sentcmd...

UBUNTU-CVE-2026-99020

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix nlinearranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as nlinearranges, but tps65224bucks234ranges only has two entries, covering selectors 0x00-0x45. The line...

UBUNTU-CVE-2026-99077

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

UBUNTU-CVE-2026-98932

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

UBUNTU-CVE-2026-98992

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

UBUNTU-CVE-2026-99048

In the Linux kernel, the following vulnerability has been resolved: gve: fix napidisable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napidisable and napienable. However, the netdev lock has already been acquired before ndobpf is calle...