UBUNTU-CVE-2026-72291

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in trygetlockedpte Fix an unlikely race in trygetlockedpte, which could have happened if puds or pmds get unmapped between the p?dpget and p?doffset functions...

UBUNTU-CVE-2026-72481

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2csmbusreadi2cblockdataoremulated...

UBUNTU-CVE-2026-74349

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2trimmainbm trims the global bitmap in cluster units, but its too-short range validation only checks sb-sblocksize. On filesystems with a cluster size larger than the block...

UBUNTU-CVE-2026-72308

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspportlagjoin When mlxswspportlagindexget fails, mlxswspportlagjoin returns an error without releasing the lag reference obtained by the earlier mlxswsplagget. All other error paths in the functio...

UBUNTU-CVE-2026-74393

In the Linux kernel, the following vulnerability has been resolved: drm/syncobj: Fix memory leak in drmsyncobjfindfence Commit 18226ba52159 "drm/syncobj: reject invalid flags in drmsyncobjfindfence" forgot to take into account the fact that drmsyncobjfind takes a reference to syncobj and returns...

UBUNTU-CVE-2026-72438

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending and barrier reference leaks on discard failures raid10makerequest acquires a writespending reference with mdwritestart before calling raid10handlediscard. Several failure paths in raid10handlediscard...

UBUNTU-CVE-2026-74404

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snpfilterreservedmemregions off-by-one Sashiko notes: regarding the bounds check in snpfilterreservedmemregions called via walkiomemresdesc: does the check if rangelist-numelements 16 + 8 PAGESIZE allow an...

UBUNTU-CVE-2026-74296

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

UBUNTU-CVE-2026-74376

In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset readslot when reusing r10bio for discard putallbios always drops devsi.bio, but it only drops devsi.replbio when r10bio-readslot 0. If discard reuses an r10bio that was previously used for a read, readslot can...

UBUNTU-CVE-2026-74348

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

UBUNTU-CVE-2026-74279

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

UBUNTU-CVE-2026-72485

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

UBUNTU-CVE-2026-72443

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to sndusbmidiv2free, which currently frees each endpoint and its coheren...

UBUNTU-CVE-2026-74352

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: avoid post-init UAF when allocreservedmemarray fails The global pointer 'reservedmem' continues to reference the reservedmemarray which lives in initdata if allocreservedmemarray fails. ofreservedmemlookup is...

UBUNTU-CVE-2026-74374

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix error-path detection with mdclonedbio Detect the error path using mdclonedbio instead of relying on r1bio in raid1 or r10bio-readslot in raid10, which may be NULL or -1 after splitting and resubmitting a fail...

UBUNTU-CVE-2026-72355

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix barriering when walking subrequest list Fix the barriering used when walking the subrequest list in retry as there's a possibility of seeing a subreq that's just been added by the application thread...

UBUNTU-CVE-2026-72377

In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of ASRELEASEALWAYS for symlinks and mountpoints Regular AFS files correctly use afsfileaops which have releasefolio set as netfsreleasefolio, so ASRELEASEALWAYS is valid for them when fscache is enabled set vi...

CVE-2026-72399

In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdpframe The size of xdpredirectarr array is ENETCMAXSKBFRAGS. However, the number of fragments contained in xdpframe may be greater than or equal to ENETCMAXSKBFRAGS, which will cau...

CVE-2026-74280

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-74393

In the Linux kernel, the following vulnerability has been resolved: drm/syncobj: Fix memory leak in drmsyncobjfindfence Commit 18226ba52159 "drm/syncobj: reject invalid flags in drmsyncobjfindfence" forgot to take into account the fact that drmsyncobjfind takes a reference to syncobj and returns...