CVE-2026-98422

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the APVLAN tailroom counter on ifdown On ifup, APVLAN interfaces get cryptotxtailroomneededcnt from the AP interface, but it's never decremented again unless the AP is also brought down. Thus, bringing the...

CVE-2026-98420: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

UBUNTU-CVE-2026-98394

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

UBUNTU-CVE-2026-98421

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS setup confirm It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame: WARNONONCE!sta || !apsta Only accept...

CVE-2026-98396: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in archexittousermodeprepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMRKUAPBLOCKED. While returning to userspace just before RFI, kern...

CVE-2026-98404

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERRPTR bug in virtiogpuuserframebuffercreate Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drmmodeaddfb2. Return an error pointer instead...

CVE-2026-98413

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avchaspermnoaudit avchaspermnoaudit is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All...

CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

UBUNTU-CVE-2026-98420

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

UBUNTU-CVE-2026-98428

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, th...

PT-2026-114366

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 crypto component where return codes from the skcipher walk virt function were not properly validated before entering processing loops in ecb aes crypt and ctr...

PT-2026-114367

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the do close on exec function is called while holding the exec update lock. Because do close on exec can block while waiting for a response from a filesystem, a hun...

PT-2026-114384

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the parse posix sids function fails to validate the server-supplied out len against the actual length of the received iov iov len. If a server...

PT-2026-114386

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds OOB write occurs in the rsi hal load key function during key removal when data is NULL. The issue stems from an incorrect subscript calculation where set key is...

PT-2026-114389

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the suspend and resume handling of the da9063 watchdog. The functions da9063 wdt suspend and da9063 wdt resume only verify watchdog active. If the driver sets WDOG HW...

PT-2026-114405

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mwifiex pcie request irq function where an incorrect index is used during the MSI-X error path. When request irq fails, the cleanup loop attempts to free previousl...

PT-2026-114406

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CoDel control law where very small intervals can cause the scheduled step to round down to zero. This prevents the dropping loop in the codel dequeue function from...

PT-2026-114407

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The USB 6fire driver in the ALSA Advanced Linux Sound Architecture subsystem uses URBs USB Request Blocks embedded within different structures for PCM, MIDI, and communication. Because...

UBUNTU-CVE-2026-98411

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseqdeviceregister If devsetname fails in pwrseqdeviceregister, we jump to the errputpwrseq label before initializing pwrseq-targets. pwrseqrelease will try to iterate over...

UBUNTU-CVE-2026-98405

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...