UBUNTU-CVE-2026-74512

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in auditdelrule auditdelrule destroys e-rule.exe via auditremovemarkrule before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in auditfilte...

UBUNTU-CVE-2026-74505

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fix UAF at error handling during probe Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot a pending URB before freeing the resources, which may lead to a...

UBUNTU-CVE-2026-74474

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

UBUNTU-CVE-2026-74529

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

UBUNTU-CVE-2026-74467

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAPNETADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE and SIOCQETHQUERYOAT with CAPNETADMIN capable check to ensure unprivileged users cannot invoke...

UBUNTU-CVE-2026-74446

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold eventmutex while checkpointing CRIU events kfdcriucheckpointevents counts the entries in p-eventidr via kfdgetnumevents, allocates an array sized to that count, and then walks the same IDR to fill it. Neither the...

UBUNTU-CVE-2026-74443

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...

UBUNTU-CVE-2026-74507

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA transactio...

CVE-2026-74490

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipcskdump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sklock.slock, but tipcpoll calls...

CVE-2026-74489

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

CVE-2026-74544

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: validate offshift to prevent shift-out-of-bounds u32change copies the user-provided tcu32sel.offshift unsigned char, 0-255 into the kernel knode object without bounds validation. When a packet later hits...

CVE-2026-74486

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

CVE-2026-74540

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2capleconnectrsp l2capleconnectrsp obtains a channel via l2capgetchanbyident but neither holds a reference nor uses l2capchanholdunlesszero before locking and operating on it. A concurrent l2capchand...

UBUNTU-CVE-2026-74444

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

UBUNTU-CVE-2026-74527

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX PKIND state PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC ...

CVE-2026-74546

In the Linux kernel, the following vulnerability has been resolved: hwmon: adt7470 Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FANDATAVALID check and the FANPERIODTORPM conversion, it will result in a divide-by-zero crash due to a race with a concurrent...

CVE-2026-74449

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculatemcachesetting on zero viewport If a plane reaches calculatemcachesetting with a zero-area viewport, calculatemcachesetting exits early with nummcaches == 0 and mvmpgwidth/height == ...

CVE-2026-74524

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove removepudmapping and removep4dmapping obtain a child table base with pudoffsetp4dp, 0 and p4doffsetpgd, 0, then add the index for addr. RISC-V folds page-table...

CVE-2026-74521

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

UBUNTU-CVE-2026-74449

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculatemcachesetting on zero viewport If a plane reaches calculatemcachesetting with a zero-area viewport, calculatemcachesetting exits early with nummcaches == 0 and mvmpgwidth/height == ...