UBUNTU-CVE-2026-72362

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

UBUNTU-CVE-2026-74418

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Tracedmafencesignaled, tracedmafencewaitend and tracedmafencedestroy can all currently dereference a null fence-ops pointer after it has been reset on fence signalling...

UBUNTU-CVE-2026-74403

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass it directly to pageaddress? On architectures without HASHEDPAGEVIRTUA...

UBUNTU-CVE-2026-74263

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skbclone in control TX t7xxportctrltx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skbclone failure results in a NULL pointer...

UBUNTU-CVE-2026-72403

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

UBUNTU-CVE-2026-72385

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobefgraphentry fprobefgraphentry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcureadlock only. A fprobe...

UBUNTU-CVE-2026-74259

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

UBUNTU-CVE-2026-74304

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

UBUNTU-CVE-2026-72424

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

UBUNTU-CVE-2026-74286

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

UBUNTU-CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

UBUNTU-CVE-2026-74274

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

UBUNTU-CVE-2026-74400

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-72343

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...

CVE-2026-72458

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpackpdb pdb-dfa could be NULL if unpackdfa fails, causing a NULL pointer dereference...

CVE-2026-72432

In the Linux kernel, the following vulnerability has been resolved: tpmcrb: Check ACPICOMPANION against NULL during probe Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on the...

CVE-2026-72502

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-74256

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

CVE-2026-74327

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in isvmareahugepages findvmarea can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash...