UBUNTU-CVE-2026-100073

In the Linux kernel, the following vulnerability has been resolved: ext4: fix transaction overflow during writeback Commit 95ad8ee45cdb "ext4: correct the reserved credits for extent conversion" was correct to note that we need to reserve enough credits for all extents possibly underlying a large...

UBUNTU-CVE-2026-100077

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be...

UBUNTU-CVE-2026-51773

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

UBUNTU-CVE-2026-95832

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because colorcontrol in kitty/window.py...

UBUNTU-CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

UBUNTU-CVE-2026-98031

In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in removenhgrpentry removenhgrpentry prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a...

UBUNTU-CVE-2026-98133

In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA hides existing on-di...

UBUNTU-CVE-2026-97942

In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Exclude text poking against changepageattr From time to time, the following BUG can be observed in the x86 alternatives patching code 0: kernel BUG at arch/x86/kernel/alternative.c:2576! Oops: invalid opcode: 00...

UBUNTU-CVE-2026-98067

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

UBUNTU-CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

UBUNTU-CVE-2026-97595

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154subifframe queues received beacon and MAC-command frames onto local-rxbeaconlist / rxmaccmdlist and schedules a process-context worker,...

UBUNTU-CVE-2026-97557

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

UBUNTU-CVE-2026-97901

In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and...

UBUNTU-CVE-2026-98037

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...

UBUNTU-CVE-2026-97983

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GETFD, this...

UBUNTU-CVE-2026-98128

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

UBUNTU-CVE-2026-97604

In the Linux kernel, the following vulnerability has been resolved: fbdev: vfb: defer cleanup until the last reference FBIOGETCMAP takes a shallow snapshot of info-cmap and performs the usercopy after dropping info-lock. vfbremove frees the colormap immediately after unregistering the framebuffer...

UBUNTU-CVE-2026-97600

In the Linux kernel, the following vulnerability has been resolved: ieee802154: cc2520: fix FIFOP work use-after-free The FIFOP interrupt handler queues cc2520fifopirqwork. On removal, cc2520remove only flushes the work. The devm-managed FIFOP IRQ remains active until after -remove returns and ca...

UBUNTU-CVE-2026-98001

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize onl...

UBUNTU-CVE-2026-97909

In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ unireaderinit registers the shared IRQ before initializing reader-irqlock. A pending interrupt can invoke the handler while the lock is still uninitialized. Initialize the lock...

UBUNTU-CVE-2026-97616

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...

UBUNTU-CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

UBUNTU-CVE-2026-98010

In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drrchangeclass rejects explicit quantum==0 but falls back to pschedmtu with no floor. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 or a zero pschedmtu on a...

UBUNTU-CVE-2026-98011

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhfchange accepts any quantum from userspace, including 1. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times und...

UBUNTU-CVE-2026-98055

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Clean up the bus when fetching ML caps fails sndhdacextbusgetmlcapabilities may fail and its return code shall be checked and accounted for. Address the issue by updating the error-path for avspciprobe. At the...

UBUNTU-CVE-2026-98114

In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parsedacl silently accepts truncated ACEs and allocation failures, allowing setinfosec to continue with an incomplete ACL conversion. Return parsing and allocation errors to parsesecdesc so...

UBUNTU-CVE-2026-98042

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't resurrect a scalar id dropped by collectlinkedregs checkcondjmpop copies the compared registers into env-false,truereg1,2 before collectlinkedregs runs and copies those snapshots back into both branch states afterwards...

UBUNTU-CVE-2026-98142

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

UBUNTU-CVE-2026-97535

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound VP index against VPCTRL IOCB bitmap size The VP control IOCB selects its target virtual port by setting one bit in vpidxmap, a fixed 16-byte 128-bit array in both vpctrlentry24xx and vpctrlentry24xxext...

UBUNTU-CVE-2026-98093

In the Linux kernel, the following vulnerability has been resolved: ASoC: fslmicfil: balance mclk enable/disable hwparams enables mclk unconditionally and hwfree disables it unconditionally, but the PCM core does not guarantee 1:1 pairing: hwfree can run without hwparams, and hwparams can be call...

UBUNTU-CVE-2026-98017

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTMNEWQDISC request can make clsact bind a populated shared ingress block during -init, publishing an embedded miniQdisc to lockless readers. If the same request has an...

UBUNTU-CVE-2026-97969

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix clock leak and spurious timer in settimeout msc313ewdtsettimeout unconditionally calls msc313ewdtstart which introduces two severe bugs: 1. If the watchdog is already active, calling start again will increa...

UBUNTU-CVE-2026-98151

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following unprivileged program as an example: r0 = bpfmaplookupelem... / PTRTOMAPVALUE, offset 0 / ... 14: r0 += r1 / r1 is a bounded scalar / 15: r9 = ...

UBUNTU-CVE-2026-98056

In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvmescannslist drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvmefindgetns to look the namespace up and removes ...

UBUNTU-CVE-2026-98097

In the Linux kernel, the following vulnerability has been resolved: tipc: Dont send random pad bytes in RESET/ACTIVATE messages The interface name is passed in a fixed length TIPCMAXIFNAME buffer. Replace the strcpydata, l-ifname with memcpy so that the pad bytes are actually written l-ifname is...

UBUNTU-CVE-2026-97612

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre-encapsulation network header once, gated on !skb-innerprotocol. skbmplspop never clears that record, so it outlives the encapsulation it...

UBUNTU-CVE-2026-97949

In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfsgetconfigitem treats a hashed dentry as proof that sd-selement is a live configitem. configfsrmdir breaks that: simplermdir leaves the dentry hashed, the last...

UBUNTU-CVE-2026-97938

In the Linux kernel, the following vulnerability has been resolved: reboot: fix cadpid use-after-free race cadpid is a single kernel-wide struct pid pointer. procdocadpid reads it and passes it to pidvnr without protecting the lifetime of the referenced struct pid. A concurrent writer can replace...

UBUNTU-CVE-2026-97927

In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufsfillsuper installed sb-sroot before it loaded the cylinder group structures for a writable mount: sb-sroot = dmakerootinode; ... if !sbrdonlysb if...

UBUNTU-CVE-2026-97966

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: reset HTB scheduler topology before freeing queues HTB offload programs NIXAFTLxXTOPOLOGY on QoS-allocated scheduler queues via otx2qostxschqsetparenttopology, but teardown freed those queues without clearing...

UBUNTU-CVE-2026-98008

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

UBUNTU-CVE-2026-97937

In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copyexecstate duptaskstruct copies the parent's taskstruct, including retstack. ftracegraphinittask clears the copied function graph state, but it currently runs after...

UBUNTU-CVE-2026-97555

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

UBUNTU-CVE-2026-97974

In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6node before accessing in ip6delrtsiblings syzbot reported a null-ptr-deref in ip6delrtsiblings 0. The stack trace hinted towards a null dereference of rt-fib6node when fn-leaf is accessed in ip6delrtsiblings...

UBUNTU-CVE-2026-97899

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leak in queryperfconfiglist When krealloc fails, free the original oaconfigids before returning to avoid a memory leak. cherry picked from commit 9977e9d84f46d4f12ad35fbbc0ec4638554bce87...

UBUNTU-CVE-2026-97549

In the Linux kernel, the following vulnerability has been resolved: xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on XFS for-next as of 7.3-rc2 with MKFSOPTIONS="-n size=8192", I observed the following trimmed dmesg splat: XFS: Assertion failed: args-total =...

UBUNTU-CVE-2026-98006

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Decoupling ep1inurb in caiaq dev The epqinurb object belonging to the caiaq device is coupled within the struct sndusbcaiaqdev. After usbsubmiturbepqinurb, GFPKERNEL executes successfully, epqinurb is successfully...

UBUNTU-CVE-2026-97607

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpaallocdevice so the allocated device and adapter pointer are released consistently...

UBUNTU-CVE-2026-97902

In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a "fs: handle freezing from multiple devices" replaced the freezeholders bitmask with per-holder counters to allow nested freezes. In the bitmask version, a th...

UBUNTU-CVE-2026-98003

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Do not reallocate GA log buffers on resume Commit c5e1a1eb9279 "iommu/amd: Simplify and Consolidate Virtual APIC AVIC Enablement" moved the GA log allocation from iommuinitpci to enableiommusvapic, which is called on...