UBUNTU-CVE-2026-80883

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1xclientregister function is called just prior to register map initialization loop, making the device available to userspace. This m...

UBUNTU-CVE-2026-80880

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP reregmr Due to all the child mkeys in the implicit ODP configuration we cannot change anything in place for the parent mkey. Instead the whole thing needs to be rebuilt if any change is...

CVE-2026-80881

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2readblocks In ocfs2readblocks, caller should't assume that buffer head returned by 'sbgetblk' is exclusively owned and so 'putbh' always drops bcount from 1 to 0. If it is not so, buffer...

CVE-2026-80882

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegraccmdoonereq...

CVE-2026-80884

In the Linux kernel, the following vulnerability has been resolved: ntb: Store original DMA address for future release The DMA API requires that dmafreeattrs receive the exact dmahandle originally returned by the allocation function. Do not modify it...

CVE-2026-80886

In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from userspace and the kernel to the console can trigger a race condition that results in an infinite loop of the same messages printed over and ov...

UBUNTU-CVE-2026-80884

In the Linux kernel, the following vulnerability has been resolved: ntb: Store original DMA address for future release The DMA API requires that dmafreeattrs receive the exact dmahandle originally returned by the allocation function. Do not modify it...

UBUNTU-CVE-2026-80886

In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from userspace and the kernel to the console can trigger a race condition that results in an infinite loop of the same messages printed over and ov...

UBUNTU-CVE-2026-80885

In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processing typically to respond to security challenges. Also move OOB message processing to afswq so that it's also waited for and make the OOB...

UBUNTU-CVE-2026-80869

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the attribute-list entry in ntfsreadinodemount The $MFT attribute-list walk in ntfsreadinodemount validates each entry only with "u8 alentry + 6 alend" and "u8 alentry + le16tocpualentry-length alend", but then reads...

UBUNTU-CVE-2026-80871

In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove cryptorng interface Implementing the cryptorng interface has no purpose, as it isn't used in practice. It's being removed from other drivers too. Just remove it. This leaves hwrng, which is actually...

UBUNTU-CVE-2026-80875

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeofstruct ipv6hdr, while the surrounding IPVS code already parsed the packet with ipvsfilliphsk...

UBUNTU-CVE-2026-80874

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide: Describe inline ECC carveouts The DBSC5 DRAM controller protects DRAM content using inline ECC. The inline ECC utilizes areas of DRAM for its operation, which are in the DRAM address range, but must...

UBUNTU-CVE-2026-80872

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

CVE-2026-80876

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix event length with forced 8-byte alignment When RBFORCE8BYTEALIGNMENT is true, rbcalculateeventlength reserves the space of event-array0 for placing the data length and rbupdateevent stores the data length in...

CVE-2026-80873

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESREL2 for injected nested SError exceptions kvminjectel2exception writes ESREL2 for synchronous exceptions but not for SError. enterexception64 does not write ESRELx for any exception type, so the construct...

CVE-2026-80870

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

CVE-2026-80868

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Allocate iomap inlinedata using allocpage This fixes a BUG reported in iomapwriteendinline: iomapinlinedatavalid checks that the inlinedata fits within a page. If the inlinedata is allocated with kmemdup there's no guarant...

CVE-2026-80877

In the Linux kernel, the following vulnerability has been resolved: afs: Fix vllist leak Fix a leak of the new vllist in afsupdatecell in the event that it is an empty list nrservers == 0, in which case the old list isn't displaced unless the old list is also empty...

CVE-2026-80874

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide: Describe inline ECC carveouts The DBSC5 DRAM controller protects DRAM content using inline ECC. The inline ECC utilizes areas of DRAM for its operation, which are in the DRAM address range, but must...