CVE-2026-74406

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

UBUNTU-CVE-2026-72453

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, and if cache operations include an exit callback, the error code from...

UBUNTU-CVE-2026-72377

In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of ASRELEASEALWAYS for symlinks and mountpoints Regular AFS files correctly use afsfileaops which have releasefolio set as netfsreleasefolio, so ASRELEASEALWAYS is valid for them when fscache is enabled set vi...

UBUNTU-CVE-2026-74429

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpcreceivingreply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call ...

CVE-2026-74418

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Tracedmafencesignaled, tracedmafencewaitend and tracedmafencedestroy can all currently dereference a null fence-ops pointer after it has been reset on fence signalling...

CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

CVE-2026-72377

In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of ASRELEASEALWAYS for symlinks and mountpoints Regular AFS files correctly use afsfileaops which have releasefolio set as netfsreleasefolio, so ASRELEASEALWAYS is valid for them when fscache is enabled set vi...

CVE-2026-72327

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

CVE-2026-72373

In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afsbreaksomecallbacks Fix afsbreaksomecallbacks to check to see if afslookupvolumercu returned NULL e.g. the specified volume is unknown...

CVE-2026-74335

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpftaskfromvpid bpftaskfromvpid looks up a task in the pid namespace of the current task, via findtaskbyvpid: findtaskbyvpidvpid findtaskbypidnsvpid, taskactivepidnscurrent findpidnsnr, ns -...

CVE-2026-72362

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

CVE-2026-74425

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

CVE-2026-72453

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, and if cache operations include an exit callback, the error code from...

CVE-2026-74263

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skbclone in control TX t7xxportctrltx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skbclone failure results in a NULL pointer...

CVE-2026-74366

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

CVE-2026-74274

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

CVE-2026-74400

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74266

In the Linux kernel, the following vulnerability has been resolved: net/sched: schdualpi2: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog befo...

CVE-2026-72485

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

UBUNTU-CVE-2026-72327

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...