UBUNTU-CVE-2026-97939

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

UBUNTU-CVE-2026-97579

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdecav1slicesetuptile copies tilecols + 1 / tilerows + 1 entries into micolstarts / mirowstarts from the bitstream tileinfo. Bound the copy to the array...

UBUNTU-CVE-2026-98025

In the Linux kernel, the following vulnerability has been resolved: net: usb: cx82310eth: drop URB after 0xffff reboot sentinel to prevent partialdata heap overflow The 0xffff length sentinel detects a router reboot and schedules re-enabling of ethernet mode, but then falls through to the rest of...

UBUNTU-CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

UBUNTU-CVE-2026-98102

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6mcdel1src When removing a source filter whose count reaches zero, ip6mcdel1src unlinks psf from pmc-mcasources. If the filter was previously active, the code moved psf directly into...

UBUNTU-CVE-2026-98050

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

UBUNTU-CVE-2026-97552

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise error in xfsdeferfinishone xfsdeferfinishone declares error without an initialiser and only assigns it inside the loop over dfp-dfpwork. When that list is empty the loop body never runs, control falls through to t...

UBUNTU-CVE-2026-98084

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

UBUNTU-CVE-2026-97546

In the Linux kernel, the following vulnerability has been resolved: xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xrepdirrecoverdata can spin forever if it encounters an unused dirent that claims to have length zero. Fix that, and prevent the same thing fro...

UBUNTU-CVE-2026-97960

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Prevent drainpebs reentry The PEBS buffer is shared by all events on a CPU, so drainpebs must not be reentered. If so, one instance may observe stale buffer state and potentially access out-of-bound memory. Most...

UBUNTU-CVE-2026-97562

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after iteratesuperstype has dropped sumount and its passive reference. Concurrent...

UBUNTU-CVE-2026-97946

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

UBUNTU-CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

UBUNTU-CVE-2026-97564

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

UBUNTU-CVE-2026-97936

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from the histogram stacktrace modifier parsefield sets HISTFIELDFLSTACKTRACE from the ".stacktrace" modifier before it looks the field name up, and nothing afterwards checks that the name resolved t...

UBUNTU-CVE-2026-97951

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix hang for aborted WRITEPENDING commands When a LUNRESET aborts a WRITE command that is in the TRANSPORTWRITEPENDING state, the target core sets CMDTABORTED and waits for the frontend to finish processing. ...

UBUNTU-CVE-2026-98099

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

UBUNTU-CVE-2026-98088

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

UBUNTU-CVE-2026-98066

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch...

UBUNTU-CVE-2026-98131

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmactsoxmit In stmmactsoxmit, if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before t...

UBUNTU-CVE-2026-98115

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

UBUNTU-CVE-2026-97578

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchipvpu981av1decsettileinfo divides contextupdatetileid by tileinfo-tilecols and writes one descriptor per tile into the tileinfo DMA buffer, which holds...

UBUNTU-CVE-2026-98132

In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACKZERO states.c:cleanfuncstate can downgrade scalar zero spill to STACKZERO in the following case: u64 r10 - 8 = 0; ... checkpoint ... r1 = u32 r10 - 4; ... no reads from...

UBUNTU-CVE-2026-97600

In the Linux kernel, the following vulnerability has been resolved: ieee802154: cc2520: fix FIFOP work use-after-free The FIFOP interrupt handler queues cc2520fifopirqwork. On removal, cc2520remove only flushes the work. The devm-managed FIFOP IRQ remains active until after -remove returns and ca...

UBUNTU-CVE-2026-97901

In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and...

UBUNTU-CVE-2026-97524

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive path can recursively call mptcpdataready via state change under unlucky error conditions, and then try to hold the data lock again. Break the...

UBUNTU-CVE-2026-97532

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

UBUNTU-CVE-2026-98093

In the Linux kernel, the following vulnerability has been resolved: ASoC: fslmicfil: balance mclk enable/disable hwparams enables mclk unconditionally and hwfree disables it unconditionally, but the PCM core does not guarantee 1:1 pairing: hwfree can run without hwparams, and hwparams can be call...

UBUNTU-CVE-2026-97611

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tblmaskarrayrealloc retires the old maskarray before it stops being reachable: old = ovsldereferencetbl-maskarray; if old ... callrcu&old-rcu, maskarrayrcucb;...

UBUNTU-CVE-2026-97949

In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfsgetconfigitem treats a hashed dentry as proof that sd-selement is a live configitem. configfsrmdir breaks that: simplermdir leaves the dentry hashed, the last...

UBUNTU-CVE-2026-98154

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double...

UBUNTU-CVE-2026-97904

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

UBUNTU-CVE-2026-98158

In the Linux kernel, the following vulnerability has been resolved: pppasync: drop the errored frame instead of resetting its headroom pppreceivenonmpframe prepends a two-byte direction tag before running the pass/active BPF filters: be16 skbpushskb, 2 = htonsPPPFILTERINBOUNDTAG; Nothing on the...

UBUNTU-CVE-2026-97538

In the Linux kernel, the following vulnerability has been resolved: hwmon: asusrogryujin Validate HID report lengths rogryujinrawevent parses response headers and payload fields without first checking that they are present in the received report. A short report can therefore make the driver consu...

UBUNTU-CVE-2026-97581

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity preparetileinfobuffer writes one entry per tile into the tilesizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded...

UBUNTU-CVE-2026-97948

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver The commit 1010b4c012b0 "powerpc/eeh: Make EEH driver device hotplug safe" refactored the EEH code such that the pcirescanremovelock is held at the...

UBUNTU-CVE-2026-98104

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

UBUNTU-CVE-2026-98136

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfsattrfindinattrdef walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for ad = vol-attrdef; u8 ad - u8...

UBUNTU-CVE-2026-97572

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate RX ring init failures in bnxtinitnic bnxtinitrxrings returns an error when bnxtalloconerxring fails, but bnxtinitnic discards that return value and calls bnxtinitchip, which enables TPA. If an allocation fails,...

UBUNTU-CVE-2026-97924

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Don't destroy fields when event removal fails destroyuserevent destroys the event's fields before attempting to remove the trace event call. If usereventsetcallvisible fails, e.g. because the event is still...

UBUNTU-CVE-2026-97612

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre-encapsulation network header once, gated on !skb-innerprotocol. skbmplspop never clears that record, so it outlives the encapsulation it...

UBUNTU-CVE-2026-97974

In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6node before accessing in ip6delrtsiblings syzbot reported a null-ptr-deref in ip6delrtsiblings 0. The stack trace hinted towards a null dereference of rt-fib6node when fn-leaf is accessed in ip6delrtsiblings...

UBUNTU-CVE-2026-98113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

UBUNTU-CVE-2026-98026

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: properly convert mglist to rcu Sashiko reported a bug 1 that brmulticastdelportgroup unlists the port group not using proper rcu helper that preserves the next pointer and after that immediately frees the port...

UBUNTU-CVE-2026-98031

In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in removenhgrpentry removenhgrpentry prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a...

UBUNTU-CVE-2026-97549

In the Linux kernel, the following vulnerability has been resolved: xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on XFS for-next as of 7.3-rc2 with MKFSOPTIONS="-n size=8192", I observed the following trimmed dmesg splat: XFS: Assertion failed: args-total =...

UBUNTU-CVE-2026-98002

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amdiommupdomidalloc returns an int: a domain ID on success, or the negative errno from idaallocrange when the ID space is exhausted or memory is short...

UBUNTU-CVE-2026-98090

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfsinitnewdevice switches latestdev and possibly sbdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the...

UBUNTU-CVE-2026-97945

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix user-space data loss with MADVFREE and THP Some of users of Polars a data analytics library have lost production data from this bug. They seem to have just the right combination of huge pages, MADVFREE and heavy recla...

UBUNTU-CVE-2026-98021

In the Linux kernel, the following vulnerability has been resolved: net: reject oversized txqueuelen at netlink parse time rtnlcreatelink assigns IFLATXQLEN directly to dev-txqueuelen without going through netifchangetxqueuelen, so a device created with "ip link add ... txqueuelen 500000" bypasse...