UBUNTU-CVE-2026-74409

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

UBUNTU-CVE-2026-74435

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpcverifydata ensure rxdecbuffer alloc rxrpcrecvmsgdata calls rxrpcverifydata whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However,...

UBUNTU-CVE-2026-74333

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated with exactly numends entries. If all entries are initialised, the loop...

UBUNTU-CVE-2026-74332

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74404

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snpfilterreservedmemregions off-by-one Sashiko notes: regarding the bounds check in snpfilterreservedmemregions called via walkiomemresdesc: does the check if rangelist-numelements 16 + 8 PAGESIZE allow an...

UBUNTU-CVE-2026-74256

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

UBUNTU-CVE-2026-72399

In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdpframe The size of xdpredirectarr array is ENETCMAXSKBFRAGS. However, the number of fragments contained in xdpframe may be greater than or equal to ENETCMAXSKBFRAGS, which will cau...

UBUNTU-CVE-2026-74306

In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix fpos race in qatvfresumewrite qatvfresumewrite checks filp-fpos before taking migf-lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurrent write...

UBUNTU-CVE-2026-72301

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...

UBUNTU-CVE-2026-74297

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size setrqsize computes the RQ WQE size as "1 rqwqeshift" based on the user-provided rqwqeshift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shi...

CVE-2026-74411

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

CVE-2026-72318

In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parsedfsreferrals validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server. Those offsets a...

UBUNTU-CVE-2026-72310

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

UBUNTU-CVE-2026-74419

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Adjust size for copytouser The amount of data returned to user space should be limited by the buffer size provided by the application. If the buffer is smaller than the data size, return only the portion that fits...

UBUNTU-CVE-2026-74391

In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seqbuf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAXFILTERSTRVAL buffers. The current code appends those strings with ra...

UBUNTU-CVE-2026-72465

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in rpcrdmareplyhandler branches away before the credit clamp, so a reply that matches no pending request reaches outpost carrying the raw credit value...

CVE-2026-74438

In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rngalg Remove sun4issrng, as it is insecure and unused: - It has multiple vulnerabilities. sun4issprngseed is missing locking and has a buffer overflow. sun4issprnggenerate fails to...

CVE-2026-72408

In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket enabled IFLAGENEVEGROHINT gs-grohint. genevegrocomplete instead calls...

UBUNTU-CVE-2026-74380

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

CVE-2026-74382

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...