UBUNTU-CVE-2026-89568

In the Linux kernel, the following vulnerability has been resolved: kho: fix size calculation in khopreservedmemoryreserve khopreservedmemoryreserve calculates the size of a preservation by doing 1 order + PAGESHIFT. Since the '1' is a 32-bit integer, it can only be shifted by 31. That is, it wil...

UBUNTU-CVE-2026-89525

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index. The val...

UBUNTU-CVE-2026-89615

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

UBUNTU-CVE-2026-80985

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys read the part of a v2 message that does not fit into the 44-byte union smcllcmsg, and both bound themselves by the si...

UBUNTU-CVE-2026-89689

In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4sequence can free the very slot it is currently processing. When the session shrinker has reduced setargetmaxslots below sefchannel.maxreqs, the shrink path checks three...

UBUNTU-CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

UBUNTU-CVE-2026-89443

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

UBUNTU-CVE-2026-89560

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

UBUNTU-CVE-2026-80982

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

UBUNTU-CVE-2026-89580

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...

UBUNTU-CVE-2026-89586

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes atascsiwritesamexlat translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by...

UBUNTU-CVE-2026-89656

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

UBUNTU-CVE-2026-89659

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive. The client survives its stateids only because destroyclient drains...

UBUNTU-CVE-2026-89476

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

UBUNTU-CVE-2026-89533

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

UBUNTU-CVE-2026-89541

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

UBUNTU-CVE-2026-89699

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

UBUNTU-CVE-2026-89662

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

UBUNTU-CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...

UBUNTU-CVE-2026-89532

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pclforeachsegment for empty chunks When a parsed chunk list contains a chunk whose chsegcount is zero, pclforeachsegment computes its inclusive upper bound as &chunk-chsegmentschsegcount - 1. chsegcount is u32, so th...

UBUNTU-CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

UBUNTU-CVE-2026-89481

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

UBUNTU-CVE-2026-89573

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...

UBUNTU-CVE-2026-89652

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

UBUNTU-CVE-2026-89448

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

UBUNTU-CVE-2026-89550

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

UBUNTU-CVE-2026-89554

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized localid in syncookie MPJOIN reconstruction mptcptokenjoincookieinitstate restores remotenonce, localnonce, backup, joinid, token and msk from the saved cookie entry when rebuilding the request socket for ...

UBUNTU-CVE-2026-89477

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctpprocessstrresetoutreq, sctpprocessstrresetaddstrmout and sctpprocessstrresetresp complete a pending stream reconfiguration request by stopping the reconf timer on the...

UBUNTU-CVE-2026-89548

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

UBUNTU-CVE-2026-89483

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

UBUNTU-CVE-2026-89622

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

UBUNTU-CVE-2026-89587

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability querycapability copies four ACPI buffer objects returned by the firmware DSM into fixed-size u816 fields in struct pfruupdatecapinfo using memcpy with the...

UBUNTU-CVE-2026-89618

In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei-children and ei-list in initei eventfscreatedir allocates the eventfsinode and initializes it with initei. But this does not initialize the eventfsinode listheads. If the eventfscreatedir fails due to memor...

UBUNTU-CVE-2026-80929

In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cadpid" entry from pidtable to kernreboottable cadpid is global, and killcadpid is only used in the root namespace. However, due to pidtablerootpermissions, a non-root user can unshare pid/user namespaces and...

UBUNTU-CVE-2026-80942

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92duinitswvars The memory allocated inside rtl92duinitshareddata is not freed in any of the subsequent error paths in rtl92duinitswvars. Fix that by adding a call to...

UBUNTU-CVE-2026-80936

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlopmwork on stop mt7925 queues mlopmwork with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives...

UBUNTU-CVE-2026-80939

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot Since the hardware rfkill polling was introduced, arm64 platforms can panic with an asynchronous SError during warm reboot: SError Interrupt on CPU8, code...

UBUNTU-CVE-2026-80935

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

UBUNTU-CVE-2026-80930

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...

UBUNTU-CVE-2026-80940

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: pci: fix resource leak on failed NAPI setup rtwpciprobe allocates PCI resources through rtwpcisetupresource before it sets up NAPI. If rtwpcinapiinit fails, the error path jumps straight to errpcideclaim and skips...

UBUNTU-CVE-2026-80931

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

UBUNTU-CVE-2026-80928

In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smackfilesendsigiotask When inspecting the credentials of another task, objective credentials -realcred, accessed with taskcred must always be used. Accessing -cred on a non-current task is forbidden unless...

UBUNTU-CVE-2026-80938

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615suspend acquired the mt76 mutex and then called canceldelayedworksync on macwork. mt7615macwork acquires the same mutex via mt7615mutexacquire at the top o...

UBUNTU-CVE-2026-80933

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

UBUNTU-CVE-2026-80926

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2oplockbreaknoti reads opinfo-conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected,...

UBUNTU-CVE-2026-80927

In the Linux kernel, the following vulnerability has been resolved: timekeeping: Check the return value of tkgetauxts64 in doadjtimex If the auxiliary clock is disabled during tkgetauxts64 but is enabled before tks-clockvalid is checked, then uninitialized stackdata will be used in the calculatio...

UBUNTU-CVE-2026-80932

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

UBUNTU-CVE-2026-80944

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

UBUNTU-CVE-2026-80941

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

UBUNTU-CVE-2026-80937

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...