UBUNTU-CVE-2026-98027

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

UBUNTU-CVE-2026-98108

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

UBUNTU-CVE-2026-97570

In the Linux kernel, the following vulnerability has been resolved: bnxten: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 see commit ec4d8e7cf024 "bnxten: Add TPA ID mapping logic for 57500 chips.". bnxtallocaggidx is intended...

CVE-2026-97875

The rojo serve HTTP API (default port 34872 ) is vulnerable to DNS rebinding because it lacks Host/Origin header validation . This flaw allows a malicious webpage to access project source code, write malicious code to the local disk, and execute local programs using opener::open() without user in...

EUVD-2026-86991

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...

CVE-2026-97875 DNS rebinding vulnerability in rojo serve HTTP API

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...

EUVD-2026-86973

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

CVE-2026-98142 drm/cirrus-qemu: Validate BAR0 size during probe

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

CVE-2026-98142

A vulnerability exists in the Linux kernel 's drm/cirrus-qemu driver because it fails to validate that the BAR0 size matches the expected CIRRUS_VRAM_SIZE (4 MB) during PCI probe. If a device with a smaller BAR0 is bound, the driver allows the creation of framebuffers larger than the mapped memor...

CVE-2026-98142 drm/cirrus-qemu: Validate BAR0 size during probe

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

CVE-2026-98119

A flaw in the Linux kernel 's netfs (network filesystem) subsystem allows a local user to cause a Denial of Service (DoS) by triggering a system crash. The vulnerability occurs during unbuffered write operations under memory exhaustion conditions because the kernel fails to verify if memory alloc...

CVE-2026-98119 netfs: break unbuffered write when netfs_alloc_subrequest() fails

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...

CVE-2026-98119

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...

CVE-2026-98108 Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

CVE-2026-98107 Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...

EUVD-2026-86938

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...

CVE-2026-98107

The Linux kernel Bluetooth L2CAP component contains an out-of-bounds write vulnerability in l2cap_ecred_connect. The root cause is in l2cap_chan_connect(), where the check for pending ECRED channels incorrectly counts only deferred channels. Specifically, if 6 L2CAP sockets are connected in a spe...

CVE-2026-98107 Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...

CVE-2026-98108

The Linux kernel Bluetooth L2CAP component contains a vulnerability where l2cap_le_connect_req() fails to correctly set the channel mode, potentially allowing FLAG_DEFER_SETUP channels to send incorrect L2CAP_ECRED_CONN_RSP replies. Furthermore, because the function fails to limit the number of d...

CVE-2026-98108 Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...