CVE-2026-63841

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v5.0.1 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 742a98e2e81702df8fe1b1eccee5223220a03dc2...

CVE-2026-63808

In the Linux kernel, the following vulnerability has been resolved: e...

UBUNTU-CVE-2026-63892

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...

UBUNTU-CVE-2026-64033

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrssrvcreatepathfiles, the sysfs root folders may already have been created and srvpath-kobj may already have been initialized. If a later step...

CVE-2026-64177

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process...

CVE-2026-63837

In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output enaphcgettimex64 is setting the output parameter regardless of whether enacomphcgettimestamp succeeded or failed. When enacomphcgettimestamp returns an error, the...

CVE-2026-63953

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: fix pgtable leak in migratevmainserthugepmdpage When migratevmainserthugepmdpage jumps to unlockabort due to a PMD check failure, the pgtable allocated earlier via pteallocone is never freed, causing a memory...

CVE-2026-64041

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possible buffer overflow In fs210xeffectsceneinfo, a string was copied like this: strscpyDST, SRC, strlenSRC + 1; A buffer overflow would happen if strlenSRC = sizeofDST. Actually, strscpy must be used...

CVE-2026-64107

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512xoverclockxxxput In the pcm512x chipset driver, pcm512xoverclockxxxput is defined as a general mixer kcontrol instead of a DAPM kcontrol, so struct sndsocdapmcontext must n...

CVE-2026-53372

In the Linux kernel, the following vulnerability has been resolved: i...

CVE-2026-64052

In the Linux kernel, the following vulnerability has been resolved: block: bio-integrity: Fix null-ptr-deref in biointegritymapuser pinuserpagesfast can partially succeed and return the number of pages that were actually pinned. However, the biointegritymapuser does not handle this partial pinnin...

CVE-2026-64181

In the Linux kernel, the following vulnerability has been resolved: m...

CVE-2026-63849

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v5.0.1 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-64126

In the Linux kernel, the following vulnerability has been resolved: B...

CVE-2026-64096

In the Linux kernel, the following vulnerability has been resolved: b...

CVE-2026-64047

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sgchain entry count for wrapped skmsg ring When an skmsg scatterlist ring wraps sg.end sg.datamsgpl-sg.start, MAXSKBFRAGS - msgpl-sg.start + 1, msgpl-sg.data; This places the chain pointer at...

CVE-2026-53403

In the Linux kernel, the following vulnerability has been resolved: f...

CVE-2026-64156

In the Linux kernel, the following vulnerability has been resolved: n...

CVE-2026-63928

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...

CVE-2026-63923

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvumboxhandlerrepeventnotify rvumboxhandlerrepeventnotify in drivers/net/ethernet/marvell/ octeontx2/af/rvurep.c queues a sender-controlled REPEVENTNOTIFY request body verbatim, and...