CVE-2026-74350

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2validateinodeblock already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatmen...

UBUNTU-CVE-2026-74305

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

UBUNTU-CVE-2026-72329

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pcidev LUT The PF SR-IOV enable path caches VF pcidev pointers in dpiringtovfpcidevlut by iterating with pcigetdevice. Those entries do not own a reference, because the iterator drops the previous...

CVE-2026-72361

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hwengine: Fix double-free of managed BO in error path The error path in hwengineinit explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup action...

CVE-2026-72489

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

CVE-2026-74275

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix out-of-bounds access in cxlcancelautoattach In cxlcancelautoattach, it assumes cxled-pos is a valid index for accessing p-targets. However, cxled-pos can be set to negative errno in cxlregionsorttargets if...

UBUNTU-CVE-2026-74344

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with RBROOTCACHED. It then walks the copied root and drops each object contain...

UBUNTU-CVE-2026-74404

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snpfilterreservedmemregions off-by-one Sashiko notes: regarding the bounds check in snpfilterreservedmemregions called via walkiomemresdesc: does the check if rangelist-numelements 16 + 8 PAGESIZE allow an...

CVE-2026-72140

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbfi2cinitresource If devmplatformgetandioremapresource returns an error, mlxbfi2cinitresource frees tmpres before reading tmpres-io to get the error code. This results in a use-after-free. Sav...

CVE-2026-72111

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls markregs32range to narrow the register to the hook's valid range...

CVE-2026-72067

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

UBUNTU-CVE-2026-72255

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

UBUNTU-CVE-2026-72164

In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2IOCMOVEEXT operations, userspace supplies a physical megoal. ocfs2moveextent initializes newphyscpos from that goal and expects ocfs2probeallocgroup to replace it...

UBUNTU-CVE-2026-72199

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEXROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those check...

UBUNTU-CVE-2026-72119

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

CVE-2026-72111

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls markregs32range to narrow the register to the hook's valid range...

UBUNTU-CVE-2026-72279

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

UBUNTU-CVE-2026-72282

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...

UBUNTU-CVE-2026-72208

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

UBUNTU-CVE-2026-72285

In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVMTDXINITVM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdxtdinit first reads userdata-cpuid.nent to...