UBUNTU-CVE-2026-80654

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

UBUNTU-CVE-2026-80647

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix warning in poll cq direct mode CQs allocated by iballoccq always have a comphandler. Though in direct mode this handler is never expected to be called, it is still called when the driver is reset, triggering the...

UBUNTU-CVE-2026-80657

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmtchann has already been destroyed. Add NULL checks to...

UBUNTU-CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

UBUNTU-CVE-2026-80677

In the Linux kernel, the following vulnerability has been resolved: driver core: use READONCE for dev-driver in devhassyncstate devhassyncstate reads dev-driver twice without holding devicelock -- once for the NULL check and once to dereference -syncstate. Some callers only hold...

UBUNTU-CVE-2026-80618

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpuamdkfdgpuvmfreememoryofgpu unpinned DOORBELL and MMIO remap BOs which are pinned at allocation time before checking whether the BO is still mapped to the GPU. When...

UBUNTU-CVE-2026-80644

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

UBUNTU-CVE-2026-80646

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

UBUNTU-CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

UBUNTU-CVE-2026-80711

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWERSUPPLYPROPSTATUS to a supplier power supply. If no supplier is registered,...

UBUNTU-CVE-2026-80709

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

UBUNTU-CVE-2026-80622

In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclkcleanup This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the fileoperations structure does not specify...

UBUNTU-CVE-2026-80590

In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...

UBUNTU-CVE-2026-80606

In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifierlock for write on inject test path When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit runs vmacheckuserptr with the svm notifierlock taken for read. The test injection causes vmacheckuserpt...

UBUNTU-CVE-2026-80607

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Remove WARNONONCE from parsebtfarg Sashiko found that user can cause this WARNONONCE easily with adding a kprobe event based on a raw address with BTF parameter. Since this is not an unexpected condition, remove t...

UBUNTU-CVE-2026-80660

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ unregister sysfs devices outside occ lock occactivefalse and occshutdown unregister sysfs-backed devices while occ-lock is held. hwmondeviceunregister and sysfsremovegroup can wait for active sysfs callbacks to drain,...

UBUNTU-CVE-2026-80612

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

UBUNTU-CVE-2026-80688

In the Linux kernel, the following vulnerability has been resolved: riscv: drop init from veccheckunalignedaccessspeedallcpus This function runs within a kthread and need not necessarily finish before system finishes boot and freeinitmem unmaps the .init.text section. This function makes calls to...

CVE-2026-80724

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclockmiscdevmmap rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VMMAYWRITE set. Userspace can map the page read-only and then...

CVE-2026-80724 ptp: vmclock: prevent read-only mappings from becoming writable

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclockmiscdevmmap rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VMMAYWRITE set. Userspace can map the page read-only and then...