UBUNTU-CVE-2026-74315

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile filehash digests the first LOCKDFHHASHSIZE bytes of nfsfh.data when bucketing nlmfiles, independent of fh.size. Commit 3de744ee4e45 "lockd: Use xdrgen XDR functions fo...

UBUNTU-CVE-2026-74395

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

UBUNTU-CVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

UBUNTU-CVE-2026-72466

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdmaisbcall decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buffer...

UBUNTU-CVE-2026-72293

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: Add missing radixtreepreload in gaccessshadowfault Add missing radixtreepreload in gaccessshadowfault to guarantee forward progress. The core of gaccessshadowfault has been split into gaccessshadowfault in order ...

UBUNTU-CVE-2026-74427

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

UBUNTU-CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

UBUNTU-CVE-2026-74261

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: avoid stale FIFO cells during resize sndseqfiforesize still needs to publish the replacement pool before it waits for FIFO users. A blocking sndseqread holds f-uselock while it sleeps, so concurrent senders must be abl...

UBUNTU-CVE-2026-72332

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctxsyncdebugbo amdxdnahwctxsyncdebugbo invokes the hardware hwctxsyncdebugbo callback while holding xdna-devlock. The callback may call amdxdnacmdsubmit, which in turn calls...

UBUNTU-CVE-2026-72322

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

UBUNTU-CVE-2026-72302

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in controlupdate size calc In sofipc3controlupdate, the expectedsize calculation uses firmware-provided cdata-numelems in arithmetic that could overflow on 32-bit platforms, wrapping t...

UBUNTU-CVE-2026-72488

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...

UBUNTU-CVE-2026-72482

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptorbusy in commandioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptorbusy reference counter to pin struct gpibdescriptor across IO ioctl operation...

UBUNTU-CVE-2026-72388

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

UBUNTU-CVE-2026-74415

In the Linux kernel, the following vulnerability has been resolved: spi: atcspi200: fix use-after-free when driver unbind DMA resource is initialized after SPI controller registration. So when driver unbind, this can trigger a use-after-free when DMA is torn down while the controller is still ali...

UBUNTU-CVE-2026-72336

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

UBUNTU-CVE-2026-74288

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

UBUNTU-CVE-2026-74372

In the Linux kernel, the following vulnerability has been resolved: raid1: fix nrpending leak in REQATOMIC bad-block error path In raid1writerequest, each per-mirror loop iteration begins by incrementing rdev-nrpending. If a REQATOMIC write encounters a badblock within the requested range, the co...

UBUNTU-CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

UBUNTU-CVE-2026-72408

In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket enabled IFLAGENEVEGROHINT gs-grohint. genevegrocomplete instead calls...