UBUNTU-CVE-2026-72373

In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afsbreaksomecallbacks Fix afsbreaksomecallbacks to check to see if afslookupvolumercu returned NULL e.g. the specified volume is unknown...

UBUNTU-CVE-2026-72458

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpackpdb pdb-dfa could be NULL if unpackdfa fails, causing a NULL pointer dereference...

UBUNTU-CVE-2026-72362

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

CVE-2026-72346

In the Linux kernel, the following vulnerability has been resolved: platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume The driver registers two distinct WMI devices: a control device BITLANDWMICONTROL and an event device BITLANDWMIEVENT. During the probe phase, the...

CVE-2026-72385

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobefgraphentry fprobefgraphentry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcureadlock only. A fprobe...

UBUNTU-CVE-2026-72502

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

UBUNTU-CVE-2026-72339

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on buildskb failure qederxbuildskb and qedetparxbuildskb do not check for a NULL return from qedebuildskb. When it returns NULL under memory pressure, the functions still consume a BD...

UBUNTU-CVE-2026-74424

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-72392

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6walkcontinue on multi-batch dump inet6dumpfib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6newtable can insert a new table...

CVE-2026-72502

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-74256

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

CVE-2026-74327

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in isvmareahugepages findvmarea can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash...

CVE-2026-74424

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

UBUNTU-CVE-2026-74304

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

UBUNTU-CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

UBUNTU-CVE-2026-74342

In the Linux kernel, the following vulnerability has been resolved: kernfs: link kn to its parent before the LSM init hook After commit 12e9e3cd03b5 "simpexattr: use per-sb cache", kernfsxattrset and kernfsxattrget compute the cache via kernfsrootkn before any other check. kernfsrootkn walks...

CVE-2026-74414

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...

UBUNTU-CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

UBUNTU-CVE-2026-74286

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...