UBUNTU-CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

UBUNTU-CVE-2026-80903

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails before the point of no return fence allocation, config buffer...

UBUNTU-CVE-2026-80899

In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend entirely EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a loc...

UBUNTU-CVE-2026-80895

In the Linux kernel, the following vulnerability has been resolved: mshv: Order ptvparray publish against irqfd assertion path mshvpartitionioctlcreatevp initialises a VP struct allocations, mutexinit, initwaitqueuehead, page mappings and then publishes the pointer into partition-ptvparray. Sever...

UBUNTU-CVE-2026-80888

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...

UBUNTU-CVE-2026-57160

PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsipgenericarrayhdrprint in pjsip/src/pjsip/sipmsg.c, the function that serializes generic array headers such as Allow, Require, Supported, and Unsupported. Unde...

UBUNTU-CVE-2026-80901

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix the checksum validations ipvsinicmpv6 is missing checksum validation for ICMPv6 packets from clients. In fact, as for TCP/UDP we should validate the checksum for ICMP packets only when we mangle the packets on MASQ or o...

UBUNTU-CVE-2026-18540

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume...

UBUNTU-CVE-2026-80896

In the Linux kernel, the following vulnerability has been resolved: mshv: Fix race in mshvirqfddeassign mshvirqfddeactivate and the hlist traversal of ptirqfdslist require pt-ptirqfdslock to be held, but mshvirqfddeassign omits it. This races with the EPOLLHUP path in mshvirqfdwakeup, which does...

UBUNTU-CVE-2026-80879

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2dioendiowrite A circular locking dependency involves INODEALLOCSYSTEMINODE, EXTENTALLOCSYSTEMINODE, and ORPHANDIRSYSTEMINODE. 1. ocfs2mknod acquires INODEALLOC then EXTENTALLOC. 2...

UBUNTU-CVE-2026-80880

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP reregmr Due to all the child mkeys in the implicit ODP configuration we cannot change anything in place for the parent mkey. Instead the whole thing needs to be rebuilt if any change is...

UBUNTU-CVE-2026-85014

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...

UBUNTU-CVE-2026-85008

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

UBUNTU-CVE-2026-84961

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

UBUNTU-CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

UBUNTU-CVE-2026-80886

In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from userspace and the kernel to the console can trigger a race condition that results in an infinite loop of the same messages printed over and ov...

UBUNTU-CVE-2026-85024

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB...

UBUNTU-CVE-2026-84947

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...

UBUNTU-CVE-2026-80885

In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processing typically to respond to security challenges. Also move OOB message processing to afswq so that it's also waited for and make the OOB...

UBUNTU-CVE-2026-80881

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2readblocks In ocfs2readblocks, caller should't assume that buffer head returned by 'sbgetblk' is exclusively owned and so 'putbh' always drops bcount from 1 to 0. If it is not so, buffer...

UBUNTU-CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

UBUNTU-CVE-2026-80882

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegraccmdoonereq...

UBUNTU-CVE-2026-80884

In the Linux kernel, the following vulnerability has been resolved: ntb: Store original DMA address for future release The DMA API requires that dmafreeattrs receive the exact dmahandle originally returned by the allocation function. Do not modify it...

UBUNTU-CVE-2026-80883

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1xclientregister function is called just prior to register map initialization loop, making the device available to userspace. This m...

UBUNTU-CVE-2026-80874

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide: Describe inline ECC carveouts The DBSC5 DRAM controller protects DRAM content using inline ECC. The inline ECC utilizes areas of DRAM for its operation, which are in the DRAM address range, but must...

UBUNTU-CVE-2026-80877

In the Linux kernel, the following vulnerability has been resolved: afs: Fix vllist leak Fix a leak of the new vllist in afsupdatecell in the event that it is an empty list nrservers == 0, in which case the old list isn't displaced unless the old list is also empty...

UBUNTU-CVE-2026-80867

In the Linux kernel, the following vulnerability has been resolved: alpha/PCI: Add securitylockeddown check to pcimmapresource Currently, Alpha's pcimmapresource does not check securitylockeddownLOCKDOWNPCIACCESS before allowing userspace to mmap PCI BARs. The generic version has had this check...

UBUNTU-CVE-2026-80878

In the Linux kernel, the following vulnerability has been resolved: afs: Fix leak of ungot volume Fix afslookupvolumercu so that it doesn't leak a dying volume if afstrygetvolume fails...

UBUNTU-CVE-2026-80871

In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove cryptorng interface Implementing the cryptorng interface has no purpose, as it isn't used in practice. It's being removed from other drivers too. Just remove it. This leaves hwrng, which is actually...

UBUNTU-CVE-2026-80875

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeofstruct ipv6hdr, while the surrounding IPVS code already parsed the packet with ipvsfilliphsk...

UBUNTU-CVE-2026-80873

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESREL2 for injected nested SError exceptions kvminjectel2exception writes ESREL2 for synchronous exceptions but not for SError. enterexception64 does not write ESRELx for any exception type, so the construct...

UBUNTU-CVE-2026-80868

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Allocate iomap inlinedata using allocpage This fixes a BUG reported in iomapwriteendinline: iomapinlinedatavalid checks that the inlinedata fits within a page. If the inlinedata is allocated with kmemdup there's no guarant...

UBUNTU-CVE-2026-80876

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix event length with forced 8-byte alignment When RBFORCE8BYTEALIGNMENT is true, rbcalculateeventlength reserves the space of event-array0 for placing the data length and rbupdateevent stores the data length in...

UBUNTU-CVE-2026-80870

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

UBUNTU-CVE-2026-80865

In the Linux kernel, the following vulnerability has been resolved: bpf: Add missing accessok call to copyusersyms As reported by sashiko we use getuser without prior accessok call on the user space pointer. Adding the missing call for the whole pointer array. Plus removing the err check in the...

UBUNTU-CVE-2026-80869

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the attribute-list entry in ntfsreadinodemount The $MFT attribute-list walk in ntfsreadinodemount validates each entry only with "u8 alentry + 6 alend" and "u8 alentry + le16tocpualentry-length alend", but then reads...

UBUNTU-CVE-2026-80866

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipcexitnet Blamed commit introduced a busy-wait loop in tipcexitnet to wait for pending UDP bearer cleanup works to complete: while atomicread&tn-wqcount condresched; This loop can busy-wait for a lon...

UBUNTU-CVE-2026-80872

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

UBUNTU-CVE-2026-80795

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...

UBUNTU-CVE-2026-80837

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: don't queue packet path object notifications All file:line references below are against v7.2-rc4 ac5b0e5651b1. The trace was captured on 7.2.0-rc6-kasan72rc6 075b74841bd0, where the same lines apply...

UBUNTU-CVE-2026-80812

In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snddummyprobe blindly trusts that the given devptr-id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if...

UBUNTU-CVE-2026-80841

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmallo...

UBUNTU-CVE-2026-80825

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated...

UBUNTU-CVE-2026-80805

In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfsattr3leafverifyentry accesses lentry/rentry fields namelen, valuelen before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the en...

UBUNTU-CVE-2026-80798

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header DSAP/SSAP + PTYPE, but the receive path never checked that a frame is at least LLCPHEADERSIZE bytes before parsing it. nfcllcprxskb...

UBUNTU-CVE-2026-80780

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...

UBUNTU-CVE-2026-80802

In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdpncii2cread takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2cmasterrecv count into a...

UBUNTU-CVE-2026-80785

In the Linux kernel, the following vulnerability has been resolved: fbdev: serialize mode sysfs access with lockfbinfo showmode, showmodes, and storemode access fbinfo-modelist and fbinfo-mode without holding lockfbinfo. storemodes takes lockfbinfo while replacing the modelist and freeing the old...

UBUNTU-CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

UBUNTU-CVE-2026-80840

In the Linux kernel, the following vulnerability has been resolved: ipv6: seg6: clear IPv4 control block on IPIP decapsulation End.DX4 and End.DT4 decapsulate an IPv4 packet through decapandvalidate and send it directly to IPv4 routing. The inner packet therefore bypasses iprcvcore, which normall...