CVE-2026-72403

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

CVE-2026-72453

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, and if cache operations include an exit callback, the error code from...

CVE-2026-72458

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpackpdb pdb-dfa could be NULL if unpackdfa fails, causing a NULL pointer dereference...

UBUNTU-CVE-2026-74379

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

UBUNTU-CVE-2026-74303

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

UBUNTU-CVE-2026-74414

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...

CVE-2026-72341

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-channelstats mlx5echannelstatsalloc publishes a new entry to priv-channelstats and then increments priv-statsnch as a publication token, but neither store carries any memory barrier:...

UBUNTU-CVE-2026-72424

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

CVE-2026-74304

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

CVE-2026-72460

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label with fnlabelbuildinscope before the nonewprivs subset check. The build helper can fail and return NULL or an ERRPTR, but the result was...

CVE-2026-74426

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

CVE-2026-72392

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6walkcontinue on multi-batch dump inet6dumpfib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6newtable can insert a new table...

CVE-2026-72502

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-74256

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

UBUNTU-CVE-2026-74259

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

UBUNTU-CVE-2026-72327

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

UBUNTU-CVE-2026-74286

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

CVE-2026-74425

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...