UBUNTU-CVE-2026-93210

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

UBUNTU-CVE-2026-93207

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpcgsswirecred at svcauthgssdecodecredbody entry svcauthgssdecodecredbody writes the caller's rpcgsswirecred field by field and assigns gcctx.len only on the success tail. The caller storage is svcdata-clcred, which...

UBUNTU-CVE-2026-93247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

UBUNTU-CVE-2026-93261

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Fix NULL pointer dereference in locksetclass registerlockclass can return NULL when the lock class pool is exhausted, graphlock fails, or key validation fails. However, locksetclass uses the return value directly...

UBUNTU-CVE-2026-93236

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon falls back to V4L2PIXFMTMPEG2. However, if a distro has locally...

UBUNTU-CVE-2026-93263

In the Linux kernel, the following vulnerability has been resolved: clk: eswin: Zero-initialize stack-allocated clkinitdata eswinclkregisterpll and eswinregisterclkdiv declare a struct clkinitdata on the stack and only initialize some of its fields parentdata respectively parenthws...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-97519 drm/xe: Fix null pointer dereference in devcoredump cleanup

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xedevcoredumpsnapshotfree, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the...

CVE-2026-97519

The Linux kernel contains a null pointer dereference vulnerability within the drm/xe component during devcoredump cleanup . Specifically, in xe_devcoredump_snapshot_free(), the ss->gt pointer may be NULL if a snapshot was never fully populated, leading to a crash when xe_guc_capture_put_matche...

CVE-2026-97519 drm/xe: Fix null pointer dereference in devcoredump cleanup

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xedevcoredumpsnapshotfree, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the...

EUVD-2026-86117

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xedevcoredumpsnapshotfree, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the...

CVE-2026-97516 wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Add NULL check for chip-edccath in rtwfwadaptivityresult It was recently reported that rtwfwadaptivityresult in fw.c dereferences rtwdev-chip-edccath without a NULL check. The issue is that devices with the 8821CE ch...

EUVD-2026-86111

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2mctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of...

CVE-2026-97513 media: chips-media: wave5: Release m2m_ctx after Instance Removed from List

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2mctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of...

CVE-2026-97513 media: chips-media: wave5: Release m2m_ctx after Instance Removed from List

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2mctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of...

CVE-2026-97513

The Linux kernel contains a vulnerability in the chips-media: wave5 driver. A use-after-free condition can occur if an IRQ thread acquires a spinlock between the release of m2m_ctx and the wave5_release function removing the stream instance from the active list. This results in a null pointer der...

CVE-2026-97508

The Linux kernel contains a vulnerability related to the thunderbolt subsystem. The issue arises because tb->root_switch is not properly set to NULL when a domain is stopped. Fixing this ensures that tb_xdp_handle_request() correctly returns an error to the remote host while maintaining the uu...

CVE-2026-97508 thunderbolt: Set tb->root_switch to NULL when domain is stopped

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb-rootswitch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tbxdphandlerequest return error to the remote host. However, we need to make sure we keep the uui...

EUVD-2026-86106

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb-rootswitch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tbxdphandlerequest return error to the remote host. However, we need to make sure we keep the uui...

CVE-2026-97506 crypto: ixp4xx - fix buffer chain unwind on allocation failure

In the Linux kernel, the following vulnerability has been resolved: crypto: ixp4xx - fix buffer chain unwind on allocation failure chainupbuffers builds a linked list of buffer descriptors for a scatterlist. If dmapoolalloc fails while constructing the list, the current code sets buf to NULL and...