UBUNTU-CVE-2026-93245

In the Linux kernel, the following vulnerability has been resolved: apparmor: policyint make sure list heads are initialized before fail path If profile create fails before policyinit is complete the list heads are not properly initialized causing profilefree sanity checks to trigger the followin...

UBUNTU-CVE-2026-93227

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: deferredgrowzone: fix out-of-range firstdeferredpfn With CONFIGDEFERREDSTRUCTPAGEINIT enabled, deferredgrowzone initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, th...

UBUNTU-CVE-2026-93232

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix boot panic with CONFIGDEBUGVM and HVO bootmem pages Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4. This series is split out from the earlier larger series "mm: Generalize HVO for HugeTLB and...

UBUNTU-CVE-2026-93258

In the Linux kernel, the following vulnerability has been resolved: ocfs2: do not use makebadinode in ocfs2readinodeblockfull This reverts commit 58b6fcd2ab34 "ocfs2: mark inode bad upon validation failure during read". Since 'makebadinode' resets inode type to SIFREG, doing this for directory...

UBUNTU-CVE-2026-93230

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic bootmem HugeTLB pages are currently initialized from hugetlbinit, but pageallocinitlate runs earlier and walks pageblocks to determine zone contiguity...

CVE-2026-97487 jfs: handle set_blocksize failures

In the Linux kernel, the following vulnerability has been resolved: jfs: handle setblocksize failures jfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97474 wifi: iwlwifi: mld: purge async notifications upon nic error

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: purge async notifications upon nic error This fixes a kernel panic in reconfig failure: 1. we have a BSS connection 2. we have a NAN connection 3. FW error occurs 4. reconfig restores the BSS connection 5...

EUVD-2026-86072

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: purge async notifications upon nic error This fixes a kernel panic in reconfig failure: 1. we have a BSS connection 2. we have a NAN connection 3. FW error occurs 4. reconfig restores the BSS connection 5...

CVE-2026-97474

The Linux kernel contains a vulnerability in the wifi: iwlwifi: mld component that causes a kernel panic during a reconfiguration failure. The root cause is a use-after-free condition: when a firmware (FW) error occurs during reconfiguration, mac80211 frees BSS connection links but fails to notif...

CVE-2026-97474 wifi: iwlwifi: mld: purge async notifications upon nic error

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: purge async notifications upon nic error This fixes a kernel panic in reconfig failure: 1. we have a BSS connection 2. we have a NAN connection 3. FW error occurs 4. reconfig restores the BSS connection 5...

CVE-2026-97441

The Linux kernel contains a vulnerability in the ahci driver where a disabled AHCI controller might report a bogus value in its HOST_CAP register. If the CAP.NP (Number of Ports) field claims more ports than the mapped BAR region can physically accommodate, accessing port registers beyond the bou...

CVE-2026-97441 ata: ahci: fail probe if BAR too small for claimed ports

In the Linux kernel, the following vulnerability has been resolved: ata: ahci: fail probe if BAR too small for claimed ports When an AHCI controller is disabled in BIOS, its HOSTCAP register may contain a bogus value, e.g. 0xFFFFFFFF. Since CAP.NP Number of Ports is a zeroes based 5-bit register...

EUVD-2026-86054

In the Linux kernel, the following vulnerability has been resolved: ata: ahci: fail probe if BAR too small for claimed ports When an AHCI controller is disabled in BIOS, its HOSTCAP register may contain a bogus value, e.g. 0xFFFFFFFF. Since CAP.NP Number of Ports is a zeroes based 5-bit register...

CVE-2026-97441 ata: ahci: fail probe if BAR too small for claimed ports

In the Linux kernel, the following vulnerability has been resolved: ata: ahci: fail probe if BAR too small for claimed ports When an AHCI controller is disabled in BIOS, its HOSTCAP register may contain a bogus value, e.g. 0xFFFFFFFF. Since CAP.NP Number of Ports is a zeroes based 5-bit register...

CVE-2026-93815

A vulnerability exists in the Linux kernel involving the au1000 driver. The au1000_close() function incorrectly calls free_irq() while holding the aup->lock spinlock. Because free_irq() can sleep while acquiring the desc->request_mutex , this violates kernel locking rules and triggers a Loc...

CVE-2026-93813 btrfs: tree-checker: validate INODE_REF's namelen

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

CVE-2026-93813

The Linux kernel contains a vulnerability in the btrfs file system where a crafted image with a corrupted INODE_REF item can trigger an out-of-boundary access. This occurs because the namelen can exceed the BTRFS_NAME_LEN limit of 255, while the allocated memory for @name remains only 255 bytes. ...

EUVD-2026-86201

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

CVE-2026-93813 btrfs: tree-checker: validate INODE_REF's namelen

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

CVE-2026-93784

A vulnerability exists in the Linux kernel 's cfg80211 component. The function cfg80211_wext_siwgenie() fails to validate the IE buffer stored via SIOCSIWGENIE , leading to an out-of-bounds read in skip_ie() and an integer underflow in memcpy during a subsequent SIOCSIWESSID connection attempt. T...