CVE-2026-98510

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

UBUNTU-CVE-2026-98835

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...

UBUNTU-CVE-2026-98770

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

UBUNTU-CVE-2026-98731

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...

UBUNTU-CVE-2026-98647

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

UBUNTU-CVE-2026-98601

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...

UBUNTU-CVE-2026-98646

In the Linux kernel, the following vulnerability has been resolved: tcp: Skip condresched in inetcsklistenstop under BPF context bpfsockdestroy runs from the tcp iterator, under rcureadlock. If the sock is a listener that still has children in its accept queue, tcpabort ends up in inetcsklistenst...

UBUNTU-CVE-2026-98748

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

CVE-2026-98786

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

CVE-2026-98549

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

UBUNTU-CVE-2026-98550

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98492

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dmaalloccoherent leak on macballoc error paths Fix 3 leaks in macballoc error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated but...

CVE-2026-98494

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98495

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arpdev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to devgetbynamercu o...

CVE-2026-98496

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

CVE-2026-98498

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix reventry reference leak in mlx5tcctsharedcounterget When the reverse entry is found but its counter is already being released, refcountincnotzero fails and the reference taken by mlx5tcctentryget is never dropped...

CVE-2026-98788

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

CVE-2026-98785

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...

CVE-2026-98774

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

CVE-2026-98718

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM before clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the source VM, as doing cache maintenance afterwards creates a tiny wind...