UBUNTU-CVE-2026-89960

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix stale pqaphook pointer on error in vfioapmdevsetkvm In vfioapmdevsetkvm, kvm-arch.crypto.pqaphook is set to &matrixmdev-pqaphook before the update locks are acquired and the mdev list is checked for a conflictin...

UBUNTU-CVE-2026-89968

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that t...

CVE-2026-90009

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-89996

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-90044

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix Use-After-Free in AIO error path In ffsepfilewriteiter and ffsepfilereaditer, when ffsepfileio fails with an error other than -EIOCBQUEUED, the iodata structure p is freed. However, for AIO operations, the...

CVE-2026-90043

In the Linux kernel, the following vulnerability has been resolved: zram: fix slot lock bit position on big-endian 64-bit The slot lock is a bit operation on the whole lock word, which flags and actime alias as two u32s. On little-endian the lock bit lands in the position ZRAMENTRYLOCK reserves i...

CVE-2026-89914

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decoderangetlbi helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not...

CVE-2026-89920

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

CVE-2026-89946

In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l33: drain threaded IRQ before runtime suspend cs35l33runtimesuspend currently switches the codec into regcachecacheonlytrue and powers it down without first quiescing the threaded IRQ registered by...

CVE-2026-89915

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

CVE-2026-89924

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix olddata leak in guest debug error path importwpinfo allocates a per-watchpoint olddata buffer to back up the original guest memory contents. If a later watchpoint of the same KVMSETGUESTDEBUG request fails to impor...

CVE-2026-90035

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix division by zero in getestimatedbw getestimatedbw divides by link-dpiabwallocconfig.bwgranularity, which is zeroed by resetbwallocstruct and only populated once DPTUNNELINGBWALLOCCAPCHANGED has been handled...

CVE-2026-90030

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active transfer. Older DWC3 programming guide revisions recommended setting...

CVE-2026-89954

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...

CVE-2026-89947

In the Linux kernel, the following vulnerability has been resolved: clk: meson: align gxbb32kclksel number of parents with actual count The following out-of-bounds read has been observed by Christian on a GXBB WeTek Hub: ================================================================== BUG: KASA...

CVE-2026-89961

In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addrpfn tracking in compound vmemmap population vmemmappopulatecompoundpages uses addrpfn to determine the PFN offset within a compound page and to decide whether the current vmemmap slot should be populated...

CVE-2026-89969

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmettcptryrecvpdu reads a PDU header into the fixed 128-byte queue-pdu union, then computes the remaining payload length as queue-left = hdr-hlen - queue-offset ...

CVE-2026-89989

In the Linux kernel, the following vulnerability has been resolved: ima: Check for ERRPTR from dentrypath in validatehashalgo dentrypath returns ERRPTR-ENAMETOOLONG when the path exceeds the buffer. validatehashalgo passes the result straight to integrityauditmsg without checking. ERRPTR is not...

CVE-2026-89963

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89936

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because t...