UBUNTU-CVE-2026-64422

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid net.ipv4.tcpreordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp-reordering field for new...

UBUNTU-CVE-2026-64271

In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet twinterrupt accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received and t...

UBUNTU-CVE-2026-64366

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacomwacqueueinsert wacomwacqueueinsert calls kfifoskip in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifoskip reads stale data lef...

UBUNTU-CVE-2026-64497

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELDGET. Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELDGET. The...

UBUNTU-CVE-2026-64360

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfsbnoderead hfsbnoderead can return early without writing to the output buffer when isbnodeoffsetvalid fails or when checkandcorrectrequested length corrects the length to zero. Callers suc...

UBUNTU-CVE-2026-64288

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet no pseudo-TLB allocated. Similarly, the TLB...

UBUNTU-CVE-2026-64465

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhcifreestreams When a USB device with active stream endpoints is disconnected, xhcifreestreams is called from the hubevent workqueue to free the stream resources. It calls...

UBUNTU-CVE-2026-64487

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser sndusbcaiaqtks4dispatch decodes the Traktor Kontrol S4 input stream in fixed 16-byte TKS4MSGBLOCKSIZE message blocks. On every iteration it advances buf a...

UBUNTU-CVE-2026-64340

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 U...

UBUNTU-CVE-2026-64259

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

UBUNTU-CVE-2026-64477

In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpumask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty t...

UBUNTU-CVE-2026-64414

In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments such as from devmem TCP, where skbfragsreadableskb returns false is processed by the u32 module, skbcopybits will safely return a negative...

UBUNTU-CVE-2026-64504

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count bmc150accelfifoflush copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 bufferBMC150ACCELFIFOLENGTH 3; which is sized fo...

UBUNTU-CVE-2026-64367

In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodixhidsetrawreport builds a protocol frame in a 128-byte stack buffer tmpbuf, writing an 11-12 byte header followed by the caller-supplied report data...

UBUNTU-CVE-2026-64261

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuseuringasyncstopqueues fuseuringasyncstopqueues might run when the last reference on ring-queuerefs was already dropped. In order to avoid an early destruction a reference on struct fuseconn ...

UBUNTU-CVE-2026-64454

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3gadgetsuspend takes dwc-lock with IRQs disabled and then calls dwc3disconnectgadget. For async callbacks that helper only uses plain spinunlock/spinlock, so the...

UBUNTU-CVE-2026-64440

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof struct HTcapselement. Because pIE-length is a raw u8 from an...

UBUNTU-CVE-2026-64403

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

UBUNTU-CVE-2026-64291

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventqdepth upper bound iommufdveventqalloc accepts any !0 veventqdepth from userspace, with an upper bound at U32MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust...

UBUNTU-CVE-2026-64344

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...