UBUNTU-CVE-2026-74641

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

UBUNTU-CVE-2026-74673

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where...

UBUNTU-CVE-2026-74678

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...

CVE-2026-74614

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b "vsock/virtio: add support for device suspend/resume" made the run flags transition from false to true when restore installs replacement virtqueues. The RX, TX...

CVE-2026-74688

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the destination transport in chunk-transport without taking a reference. When srcoutofasocok is enabled, the HEARTBEAT ACK may remain queued o...

UBUNTU-CVE-2026-74606

In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfsremoverec eventfsremoverec recursively removes the child at the current loop position. After the recursive call returns, listforeachentry advances by reading list.next from the removed child...

UBUNTU-CVE-2026-74609

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...

UBUNTU-CVE-2026-74717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...

CVE-2026-74733 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74733

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74733

A race condition in the Linux kernel's gpio: pca953x driver (managing PCA953x GPIO expanders) allows concurrent threads to access hardware registers without proper locking. The function pca953x_irq_bus_sync_unlock() performed regmap read/write operations without holding the driver's i2c_lock , wh...

CVE-2026-74733 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

EUVD-2026-64420

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

EUVD-2026-64418

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74731 sched_ext: Skip sub-disable teardown for never-linked sub-schedulers

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74732

CVE-2026-74732 is a NULL pointer dereference in the Linux kernel's drm/amd/display driver, specifically in the dce110_set_avmute function. Some older DCE timing generators do not implement is_tg_enabled in their ops table. Calling this function unconditionally when waiting for AV mute frames trig...

CVE-2026-74731

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74731

CVE-2026-74731 is a use-after-free vulnerability in the Linux kernel's sched_ext (extensible scheduler) component. When a sub-scheduler enable fails before scx_link_sched() links it into the hierarchy, the cleanup path still runs the full scx_sub_disable(). This creates a race against root disabl...

CVE-2026-74732

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110setavmute Some older DCE timing generators do not implement istgenabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference o...

CVE-2026-74731 sched_ext: Skip sub-disable teardown for never-linked sub-schedulers

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...