UBUNTU-CVE-2026-74305

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

UBUNTU-CVE-2026-74347

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used...

UBUNTU-CVE-2026-72400

In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6validatesrh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied length covers the fixed struct ipv6srhdr fields. The BPF SEG6 encap pa...

UBUNTU-CVE-2026-74324

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

UBUNTU-CVE-2026-74354

In the Linux kernel, the following vulnerability has been resolved: bpf: Take mmaplock in zappages zapvmarange requires the owning mm's mmaplock to be held. Taking mmapreadlock under arena-lock would AB-BA against arenavmclose and arenamapmmap, both of which run with mmapwritelock held and then...

UBUNTU-CVE-2026-74344

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with RBROOTCACHED. It then walks the copied root and drops each object contain...

UBUNTU-CVE-2026-72419

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having nfnatregisterfn in the call chain as a cause for the offending access:...

UBUNTU-CVE-2026-72478

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose...

UBUNTU-CVE-2026-74312

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhostvdpammap and vhostvdpafault use vma-vmpgoff as a virtqueue index for getvqnotification, but they do not validate that the index is smaller than v-nvqs. The ioctl...

UBUNTU-CVE-2026-74323

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996txprepareskb If linkconf or linksta lookup fails in mt7996txprepareskb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in case of...

UBUNTU-CVE-2026-74411

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

UBUNTU-CVE-2026-72483

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In the default branches of both the ClearPortFeature and SetPortFeature switc...

UBUNTU-CVE-2026-72333

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2capputident when the...

UBUNTU-CVE-2026-74273

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion and attachtarget, as well as the period between...

UBUNTU-CVE-2026-72335

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

UBUNTU-CVE-2026-72334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

UBUNTU-CVE-2026-72380

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

UBUNTU-CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

UBUNTU-CVE-2026-72439

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending leak on write request failures raid10makerequest acquires a writespending reference with mdwritestart before dispatching write requests. Several failure paths in raid10writerequest complete the bio an...

UBUNTU-CVE-2026-72360

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FASTREQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FASTREQUEST nor EVENT messages as this would result in...

UBUNTU-CVE-2026-74414

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...

UBUNTU-CVE-2026-72486

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

UBUNTU-CVE-2026-74271

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

UBUNTU-CVE-2026-72398

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

UBUNTU-CVE-2026-74333

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated with exactly numends entries. If all entries are initialised, the loop...

UBUNTU-CVE-2026-72303

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...

UBUNTU-CVE-2026-72491

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma-state in transrdma.c The rdma-state field is modified without holding reqlock in both recvdone and p9cmeventhandler, while rdmarequest accesses the same field under the reqlock spinlock. This...

UBUNTU-CVE-2026-72485

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

UBUNTU-CVE-2026-74372

In the Linux kernel, the following vulnerability has been resolved: raid1: fix nrpending leak in REQATOMIC bad-block error path In raid1writerequest, each per-mirror loop iteration begins by incrementing rdev-nrpending. If a REQATOMIC write encounters a badblock within the requested range, the co...

UBUNTU-CVE-2026-74412

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pcigetdrvdata type in AER handlers rtw88 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...

UBUNTU-CVE-2026-72288

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A writes to vcpu-B's ...

UBUNTU-CVE-2026-72299

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipcskenqueue runs with sk-sklock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...

UBUNTU-CVE-2026-74283

In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...

UBUNTU-CVE-2026-72323

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer A race condition exists between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, leading to a Use-After-Free in the IGMP timer callback. During device...

UBUNTU-CVE-2026-72383

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

UBUNTU-CVE-2026-72402

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs printbpfinsn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPFPSEUDOMAPFD and BPFPSEUDOMAPVALUE...

UBUNTU-CVE-2026-72413

In the Linux kernel, the following vulnerability has been resolved: sctp: fix errchunk memory leaks in INIT handling When sctpverifyinit encounters unrecognized parameters, it allocates an errchunk to report them. However, this chunk is leaked in several code paths: 1. In sctpsfdo51Binit, if...

UBUNTU-CVE-2026-74255

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipcl2sendmsg Syzbot reported a slab-use-after-free in ipvlanhardheader when called from tipcl2sendmsg. The root cause is that tipcdisablel2media calls synchronizenet while b-mediaptr is still valid. This allows...

UBUNTU-CVE-2026-74436

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpckernelchargeaccept reads rx-backlog without any socket/backlog synchronization and passes that raw pointer into rxrpcservicepreallocone. A concurrent...

UBUNTU-CVE-2026-72435

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfreercu and rcuassignpointer Sashiko pointed out that kfreercu was called before rcuassignpointer in handling the comment extension. Fix the order so that rcuassignpointer called first...

UBUNTU-CVE-2026-74289

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fibinfo in fibleafnotify. syzbot reported use-after-free in nsimfib4prepareevent. 0 The problem is that the following functions call fibinfohold / refcountinc while dumping fibinfo under RCU, which is...

UBUNTU-CVE-2026-74345

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

UBUNTU-CVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

UBUNTU-CVE-2026-72320

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlookup: fix catchall element handling with inverted lookups nftlookupeval decides whether a lookup matched found from the direct set lookup and priv-invert before falling back to the catchall element used by interva...

UBUNTU-CVE-2026-74282

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

UBUNTU-CVE-2026-74359

In the Linux kernel, the following vulnerability has been resolved: configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the first...

UBUNTU-CVE-2026-72476

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dmareleasechannel, check chan-device-privatecnt after call dmachanput. However, dmachanput call dmadeviceput which could release the last reference of the device if the DMA provider is...

UBUNTU-CVE-2026-74268

In the Linux kernel, the following vulnerability has been resolved: tcp: clear sockops cb flags before force-closing a child socket A child socket inherits the listener's bpfsockopscbflags via skclonelock. If its setup fails in tcpv4synrecvsock / tcpv6synrecvsock, the child is freed through...

UBUNTU-CVE-2026-72394

In the Linux kernel, the following vulnerability has been resolved: hwmon: aspeed-g6-pwm-tach Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeedtachvaltorpm function calculates the fan RPM using the tachometer value. However, it does no...

UBUNTU-CVE-2026-74267

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before i...