CVE-2026-74274

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

DEBIAN-CVE-2026-74274

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

DEBIAN-CVE-2026-72354

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

CVE-2026-72354

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

CVE-2026-72353

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

DEBIAN-CVE-2026-72353

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

DEBIAN-CVE-2026-72320

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlookup: fix catchall element handling with inverted lookups nftlookupeval decides whether a lookup matched found from the direct set lookup and priv-invert before falling back to the catchall element used by interva...

CVE-2026-72320

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlookup: fix catchall element handling with inverted lookups nftlookupeval decides whether a lookup matched found from the direct set lookup and priv-invert before falling back to the catchall element used by interva...

AZL-96594 CVE-2026-72320 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlookup: fix catchall element handling with inverted lookups nftlookupeval decides whether a lookup matched found from the direct set lookup and priv-invert before falling back to the catchall element used by interva...

CVE-2026-72353

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

UBUNTU-CVE-2026-74300

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes...

UBUNTU-CVE-2026-74336

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211s1gchecktim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull stores...

CVE-2026-72354

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

CVE-2026-74274

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

UBUNTU-CVE-2026-74274

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

CVE-2026-72320

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlookup: fix catchall element handling with inverted lookups nftlookupeval decides whether a lookup matched found from the direct set lookup and priv-invert before falling back to the catchall element used by interva...

UBUNTU-CVE-2026-72353

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

CVE-2026-74336

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211s1gchecktim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull stores...

UBUNTU-CVE-2026-74314

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

CVE-2026-74314

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...