CVE-2026-98215

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve user SID across nested backing files SELinux saves the user file SID in a backing-file security blob so it remains available after mmap replaces vma-vmfile with a backing file. For nested backing files overlayfs...

UBUNTU-CVE-2026-98208

In the Linux kernel, the following vulnerability has been resolved: mmc: sdiouart: fix xmitfifo leak when the port table is full sdiouartaddport allocates the transmit fifo before claiming a slot in sdiouarttable. When all UARTNR slots are taken, it returns -EBUSY with the fifo still allocated, b...

UBUNTU-CVE-2026-98359

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

UBUNTU-CVE-2026-98361

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

UBUNTU-CVE-2026-98290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98219

In the Linux kernel, the following vulnerability has been resolved: schedext: Close the pre-enable ops error claim window scxallocandaddsched publishes ops-priv before scxrootenableworkfn switches the state to SCXENABLING. An error claimed via scxbpferrorbstr from an associated BPF program in tha...

CVE-2026-98268

In the Linux kernel, the following vulnerability has been resolved: perf: Fix null pointer access in isincludeguestevent A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is something like: .. pmudetachevent...

CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98336

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't offload TC setup on APVLAN interfaces APVLAN interfaces are purely virtual, so don't try to offload TC setup to drivers. We can't really use the AP interface either since we may not know it all the time, and...

CVE-2026-98350

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: pass PMKID to firmware if present Zero out authstatus on initialization. Otherwise, garbage will leak from the stack to the firmware when ssid is less than 32 bytes and/or when params-pmkid is set. Then, pass...

CVE-2026-98372

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

CVE-2026-98359

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

CVE-2026-98360

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcgtree only after rxemcastadd succeeds rxegetmcg publishes a newly allocated multicast group in rxe-mcgtree before programming the backing Ethernet multicast address with rxemcastadd, which runs outside...

CVE-2026-98263

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98281

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...

CVE-2026-98295

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hcidevcdhandlepktinit arms dumptimeout and coredump producers queue dumprx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an acti...

CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98225

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: fix bogus setshrinkerbit with cgroup.memory=nokmem With cgroup.memory=nokmem, shrinkermemcgalloc bails out early and never allocates an id, so shrinker-id keeps the 0 it got from the kzalloc in shrinkeralloc...

CVE-2026-98220

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix NULL sched deref in kfunc sub-sched error paths When the root scheduler has sub-scheds attached, the COMPAT kfunc wrappers scxbpfselectcpuand and scxbpfdsqinsertvtime refuse the call and report to @p's scheduler:...

CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...