UBUNTU-CVE-2026-99050

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpiompsseirqenable arms the poll worker before publishing it: schedulework runs before the worker is added to priv-workers. If gpiompssedisconnect walks the list in that windo...

UBUNTU-CVE-2026-98896

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

UBUNTU-CVE-2026-99043

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

UBUNTU-CVE-2026-99053

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipcnodefindbyname returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node,...

UBUNTU-CVE-2026-99032

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...

UBUNTU-CVE-2026-99006

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...

UBUNTU-CVE-2026-98927

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

UBUNTU-CVE-2026-98932

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

UBUNTU-CVE-2026-99054

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

UBUNTU-CVE-2026-99035

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does not wait for a timeout callback that has already started. The timeout...

UBUNTU-CVE-2026-98985

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivotroot pathpivotroot reads the parents of newroot and of the caller's root and checks whether they are shared before it checks that either mount is in the caller's...

UBUNTU-CVE-2026-98982

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount dallocpseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree frees them right aw...

UBUNTU-CVE-2026-98994

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mountlock statmountmntbasic reads the ids of the parent through m-mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything abo...

UBUNTU-CVE-2026-98870

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

UBUNTU-CVE-2026-99027

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero devqueuexmit result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit ...

UBUNTU-CVE-2026-99011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

UBUNTU-CVE-2026-98972

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

UBUNTU-CVE-2026-98995

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

UBUNTU-CVE-2026-99039

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

UBUNTU-CVE-2026-98945

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This...