UBUNTU-CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

UBUNTU-CVE-2026-74303

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

UBUNTU-CVE-2026-72468

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

UBUNTU-CVE-2026-74435

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpcverifydata ensure rxdecbuffer alloc rxrpcrecvmsgdata calls rxrpcverifydata whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However,...

UBUNTU-CVE-2026-74342

In the Linux kernel, the following vulnerability has been resolved: kernfs: link kn to its parent before the LSM init hook After commit 12e9e3cd03b5 "simpexattr: use per-sb cache", kernfsxattrset and kernfsxattrget compute the cache via kernfsrootkn before any other check. kernfsrootkn walks...

UBUNTU-CVE-2026-72342

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats agent registration race mlx5ehvvhcastatscreate registers the stats agent through mlx5hvvhcaagentcreate. The helper publishes the agent in hvvhca-agentstype under agentslock and immediately schedules a...

CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74379

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-72316

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadataopen metadataopen returns NULL when kzallocobj fails, but the caller eractr only checks ISERRmd. Since ISERRNULL returns false, the NULL pointer is treated as a valid result and lat...

CVE-2026-74426

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

UBUNTU-CVE-2026-72502

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-74435

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpcverifydata ensure rxdecbuffer alloc rxrpcrecvmsgdata calls rxrpcverifydata whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However,...

CVE-2026-74418

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Tracedmafencesignaled, tracedmafencewaitend and tracedmafencedestroy can all currently dereference a null fence-ops pointer after it has been reset on fence signalling...

UBUNTU-CVE-2026-74311

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtiodevicerestore resets the device and restores the negotiated features before calling -restore. viortcfreeze intentionally leaves the existing virtqueues in place so the...

UBUNTU-CVE-2026-72327

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

UBUNTU-CVE-2026-72467

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

UBUNTU-CVE-2026-74414

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...

UBUNTU-CVE-2026-72343

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...

UBUNTU-CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

UBUNTU-CVE-2026-72377

In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of ASRELEASEALWAYS for symlinks and mountpoints Regular AFS files correctly use afsfileaops which have releasefolio set as netfsreleasefolio, so ASRELEASEALWAYS is valid for them when fscache is enabled set vi...