CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72369

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

CVE-2026-72367

In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a...

CVE-2026-72352

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hidbpfgetdata range check hidbpfgetdata returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocatedsize. The current check adds rdwrbufsize and offset before...

CVE-2026-72350

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtu32: reject invalid shift counts u32matchit executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during...

CVE-2026-72334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

CVE-2026-72326

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

CVE-2026-72310

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

CVE-2026-72303

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...

CVE-2026-72302

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in controlupdate size calc In sofipc3controlupdate, the expectedsize calculation uses firmware-provided cdata-numelems in arithmetic that could overflow on 32-bit platforms, wrapping t...

CVE-2026-72298

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...

CVE-2026-74419

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Adjust size for copytouser The amount of data returned to user space should be limited by the buffer size provided by the application. If the buffer is smaller than the data size, return only the portion that fits...

CVE-2026-74306

In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix fpos race in qatvfresumewrite qatvfresumewrite checks filp-fpos before taking migf-lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurrent write...

CVE-2026-74256

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

UBUNTU-CVE-2026-72363

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio state after ENOMEM whilst under writeback iteration Fix the state of the current folio when ENOMEM occurs during writeback iteration. The folio needs to be redirtied and unlocked before the terminal writebackiter...

UBUNTU-CVE-2026-74417

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeonalignpitch radeonalignpitch has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned cpp' calculation can overflow signed int. ...

UBUNTU-CVE-2026-72303

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...

UBUNTU-CVE-2026-74293

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fslaudmix: Validate written enum values fslaudmixputmixclksrc and fslaudmixputoutsrc convert the user-provided enum item with sndsocenumitemtoval before checking whether the item is within the enum's item count. The...

UBUNTU-CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

UBUNTU-CVE-2026-74394

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check immbuf-len is a user-controlled uint32t received from the network. Adding it to immdataoffset without overflow checking allows a malicious initiator to send...