UBUNTU-CVE-2026-80837

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: don't queue packet path object notifications All file:line references below are against v7.2-rc4 ac5b0e5651b1. The trace was captured on 7.2.0-rc6-kasan72rc6 075b74841bd0, where the same lines apply...

UBUNTU-CVE-2026-80775

In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm-futex.phash.ref allocation futexhashallocate allocates mm-futex.phash.ref without any locking. Commit d9b05321e21e "futex: Move futexhashfree back to mmput" moved the allocation here and assumed...

UBUNTU-CVE-2026-80785

In the Linux kernel, the following vulnerability has been resolved: fbdev: serialize mode sysfs access with lockfbinfo showmode, showmodes, and storemode access fbinfo-modelist and fbinfo-mode without holding lockfbinfo. storemodes takes lockfbinfo while replacing the modelist and freeing the old...

UBUNTU-CVE-2026-80816

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcpinitnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device...

UBUNTU-CVE-2026-80806

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4setinodeflagsinode, init=true in ext4newinode is made before EXT4INODEENCRYPT is set. As a result, it can set...

UBUNTU-CVE-2026-80810

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...

UBUNTU-CVE-2026-80855

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on open OTRUNC DAX failure fuseopen takes filemapinvalidatelock for a DAX truncate daxtruncate = true and releases it before the outinodeunlock label. But when fusedaxbreaklayouts fails, the goto...

UBUNTU-CVE-2026-80796

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add datalen bound checks to activation parameter extractors nciextractactivationparamsisodep and nciextractactivationparamsnfcdep read an inner length byte from the NCI RFINTFACTIVATEDNTF payload and use it to memcpy in...

UBUNTU-CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

UBUNTU-CVE-2026-80764

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

UBUNTU-CVE-2026-80800

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...

CVE-2026-80813

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmetexecuteidentifynslist is called with matchcss set...

CVE-2026-80862

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of pagefragcache nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe...

CVE-2026-80836

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtiocryptodataqakciphercallback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the origin...

CVE-2026-80779

In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...

CVE-2026-80784

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix memory leak from alloc-during-teardown race mptcppmdestroy empties msk-pm.annolist and msk-pm.userspacepmlocaladdrlist under msk-pm.lock during socket teardown, dropping the lock between the two. A concurrent...

CVE-2026-80759

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciaml: validate firmware segment lengths amldownloadfirmware reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or...

CVE-2026-80766

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: fix use-after-free of inrangetimer on remove uclogicremove cancels the pen in-range timer and then stops the device: timerdeletesync&drvdata-inrangetimer; hidhwstophdev; timerdeletesync only guarantees the timer is...

CVE-2026-80774

In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hidisusb check tousbinterface can only be used on a hiddevice whose parent is really USB; uhid can create devices that identify as being on BUSUSB, but don't actually have a USB parent. Fix the use of...

CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...