CVE-2026-98971

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

CVE-2026-99045

In the Linux kernel, the following vulnerability has been resolved: ibmveth: hfree logical LAN on open-fail after register ibmvethopen registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to outfreebufferpools without hfreelogicallan, so PHYP still owns the...

CVE-2026-99075

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

CVE-2026-99021

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in ofregulatorbulkgetall ofregulatorbulkgetall returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name se...

CVE-2026-99036

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same device...

CVE-2026-98962

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfsuringreadextent fails After btrfsuringreadextent, the caller always jumped to outacct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure,...

CVE-2026-98970

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...

UBUNTU-CVE-2026-99004

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

UBUNTU-CVE-2026-98971

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

UBUNTU-CVE-2026-98944

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and th...

UBUNTU-CVE-2026-98932

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

UBUNTU-CVE-2026-99067

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

UBUNTU-CVE-2026-98969

In the Linux kernel, the following vulnerability has been resolved: net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in emtextdump", which zero-initialised the dump-side struct. Sashiko pointed at a...

UBUNTU-CVE-2026-98942

In the Linux kernel, the following vulnerability has been resolved: schedext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.initcids overrides...

UBUNTU-CVE-2026-99010

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

UBUNTU-CVE-2026-99057

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...

UBUNTU-CVE-2026-99026

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bctransmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but teamxmit still returns NETDEVTXOK...

UBUNTU-CVE-2026-99080

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...

UBUNTU-CVE-2026-98947

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

UBUNTU-CVE-2026-99045

In the Linux kernel, the following vulnerability has been resolved: ibmveth: hfree logical LAN on open-fail after register ibmvethopen registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to outfreebufferpools without hfreelogicallan, so PHYP still owns the...