CVE-2026-64293

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

CVE-2026-64288

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet no pseudo-TLB allocated. Similarly, the TLB...

UBUNTU-CVE-2026-64457

In the Linux kernel, the following vulnerability has been resolved: virtiopci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 /sys/bus/virtio/drivers/virtioballoon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer...

UBUNTU-CVE-2026-64486

In the Linux kernel, the following vulnerability has been resolved: ALSA: cmipci: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. sndcmipcispdifcontrols does not check the return value before dereferencing kctl-id.device, which can lead to a NULL pointer...

UBUNTU-CVE-2026-64405

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL while reqstatus is still HCIREQPEND, leading to a NULL pointer dereferen...

UBUNTU-CVE-2026-64480

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. The ice1712 driver calls sndctlnew1 without checking the return value before dereferencing the pointer in multiple places...

UBUNTU-CVE-2026-64404

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in isoconnbigsync isoconnbigsync drops the socket lock to call hcigetroute and then re-acquires it, but dereferences isopisk-conn-hcon afterwards without re-checking that conn is still...

UBUNTU-CVE-2026-64417

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both countobjects and scanobjects, which is not...

UBUNTU-CVE-2026-64447

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit and ipu7psysinit, pdata is allocated and then passed to ipu7businitializedevice, which stores it in adev-pdata. The ipu7busrelease...

UBUNTU-CVE-2026-64484

In the Linux kernel, the following vulnerability has been resolved: ALSA: es1938: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. sndes1938mixer does not check the return value before dereferencing the pointer, which can lead to a NULL pointer dereference. A...

UBUNTU-CVE-2026-64451

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in funcsetflag funcsetflag dereferences tr-currenttraceflags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from...

UBUNTU-CVE-2026-64427

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e "HID: logitech-dj: Prevent REPORTIDDJSHORT related user initiated OOB write" added validation for the DJ short output report, but the error pa...

UBUNTU-CVE-2026-64511

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 "ACPI: NFIT: Install Notify handler before getting NFIT table", acpinfitprobe installs an ACPI notify handler for the NFIT device before checking t...

UBUNTU-CVE-2026-64482

In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. sndgf1pcmvolumecontrol does not check the return value before dereferencing kctl-id.index, which can lead to a NULL pointer...

UBUNTU-CVE-2026-64297

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

UBUNTU-CVE-2026-64413

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpupossiblemask lead to an uninitialized pointer free? If cpupossiblemask is sparse for example, CPU 0 and CPU 2 ar...

CVE-2026-64523 net/handshake: Take a long-lived file reference at submit

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

EUVD-2026-48859

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...

CVE-2026-64515 wifi: mac80211: fix MLE defragmentation

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...

EUVD-2026-48855

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 "ACPI: NFIT: Install Notify handler before getting NFIT table", acpinfitprobe installs an ACPI notify handler for the NFIT device before checking t...