UBUNTU-CVE-2026-64112

In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lockdwork draining on unmap Given how rbdlockaddrequest and rbdimgexclusivelock are written, lockdwork may be requeued more than it's actually needed: for example in case a new I/O request comes in while ...

UBUNTU-CVE-2026-63911

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfsclonestate clones the IPTFS mode data with kmemdup. This copies runtime objects which must not be shared with the original SA, including the embedded skbuffhead, hrtimers,...

UBUNTU-CVE-2026-64066

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsreadtopagecache to pause on subreq failure Fix netfsreadtopagecache so that it pauses the generation of new subrequests if an already-issued subrequest fails...

UBUNTU-CVE-2026-53373

In the Linux kernel, the following vulnerability has been resolved: mm/vma: do not try to unmap a VMA if mmapprepare invoked from mmap The mmapprepare hook functionality includes the ability to invoke mmapprepare from the mmap hook of existing 'stacked' drivers, that is ones which are capable of...

CVE-2026-63923

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvumboxhandlerrepeventnotify rvumboxhandlerrepeventnotify in drivers/net/ethernet/marvell/ octeontx2/af/rvurep.c queues a sender-controlled REPEVENTNOTIFY request body verbatim, and...

UBUNTU-CVE-2026-64179

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix potential memory leaks in ipcimeminit The memory allocated in ipcprotocolinit is not freed on the error paths that follow in ipcimeminit. Fix that by calling the corresponding release function ipcprotocoldein...

CVE-2026-64150

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftinner: release locallock before re-enabling softirqs Quoting sashiko: In the error path, localbhenable is called before localunlocknestedbh...

UBUNTU-CVE-2026-64059

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio-private handling in netfsperformwrite Under some circumstances, netfsperformwrite doesn't correctly manipulate folio-private between NULL, NETFSFOLIOCOPYTOCACHE, pointing to a group and pointing to a netfsfolio...

UBUNTU-CVE-2026-63892

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...

UBUNTU-CVE-2026-63933

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16260: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero to the samplingfrequency sysfs attribute triggers a division by zero...

CVE-2026-63897

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data and leaking it to user space...

CVE-2026-64078

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: add and use xtablesunregistertableexit Previous change added xtablesunregistertablepreexit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that ...

UBUNTU-CVE-2026-63951

In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zramwritebackendio A crash was observed in zramwritebackendio due to a NULL pointer dereference in wakeup. The root cause is a race condition between the bio completion handler zramwritebackendio and t...

UBUNTU-CVE-2026-64016

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...

UBUNTU-CVE-2026-64028

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

CVE-2026-63867

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

CVE-2026-63868

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...

UBUNTU-CVE-2026-63874

In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rxretry cancellation It's possible that sequencing between setting -stopped and cancelling the rxretry work in ndostop could leave us with an urb queued: T1: ndostop T2:...

CVE-2026-63872

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-63870

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpanxmit The aoe driver or similar generates a non-IPv6 packet e.g., ETHPAOE and queues it for transmission via devqueuexmit on a 6LoWPAN interface configured by the user or test...