UBUNTU-CVE-2026-72167

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x devi...

UBUNTU-CVE-2026-72214

In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmemdeviceput causing reference leak In cpcapbatterydetectbatterytype, the reference to an nvmem device obtained via nvmemdevicefind is not released with nvmemdeviceput on the success or...

UBUNTU-CVE-2026-72180

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

UBUNTU-CVE-2026-72238

In the Linux kernel, the following vulnerability has been resolved: x86/boot: Validate console=uart8250 baud rate to fix early boot hang When the baud rate is empty, 0, invalid, or overflows to 0 when stored as an int, the system will hang during early boot because of a division by zero in...

UBUNTU-CVE-2026-72278

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gues...

UBUNTU-CVE-2026-72034

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...

UBUNTU-CVE-2026-72048

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix casctl leak on spiasync failure ca8210spitransfer allocates casctl with kzallocobjGFPATOMIC and relies entirely on the SPI completion callback ca8210spitransfercomplete to free it. The spiasync API only...

UBUNTU-CVE-2026-72206

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index block header more strictly Modify ntfsindexblockinconsisent to perform stricter validation of INDEXHEADER geometry in INDX blocks, and update ntfslookupinodebyname to use that function to validate INDX blocks...

UBUNTU-CVE-2026-72124

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

UBUNTU-CVE-2026-72018

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

UBUNTU-CVE-2026-72220

In the Linux kernel, the following vulnerability has been resolved: sunrpc: harden rqprocinfo lifecycle to prevent double-free The svcreleaserqst function executes the callback inside rqstp-rqprocinfo-pcrelease. However, if a worker thread begins processing a new request and encounters an early...

UBUNTU-CVE-2026-72142

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has...

UBUNTU-CVE-2026-72126

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

UBUNTU-CVE-2026-72243

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

UBUNTU-CVE-2026-72025

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwrit...

CVE-2026-72231

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pending request batadvsendttrequest allocates a ttreqnode when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time...

UBUNTU-CVE-2026-72273

In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: fix memory leak in efifbprobe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fbgetoptions is expected to be freed by the caller, but the strin...

UBUNTU-CVE-2026-72089

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

UBUNTU-CVE-2026-72210

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

UBUNTU-CVE-2026-72067

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...