UBUNTU-CVE-2026-98109

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

UBUNTU-CVE-2026-97916

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...

UBUNTU-CVE-2026-97976

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate packetlen before skbputdata btintelpciesubmitrxwork reads packetlen from rfhhdr without checking if it exceeds the RX buffer size. An oversized packetlen can lead to an out-of-bounds read in...

UBUNTU-CVE-2026-98148

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

UBUNTU-CVE-2026-97992

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

UBUNTU-CVE-2026-97574

In the Linux kernel, the following vulnerability has been resolved: bnxten: Don't free the live ring's TPA state on queue restart failure bnxtqueuememalloc shallow copies the live RX ring into the clone: memcpyclone, rxr, sizeofrxr; the code currently clears pointers that the clone owns such as...

UBUNTU-CVE-2026-97528

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qlanvmexmtlsrsp obtains uctx, which was linked into fcport-unsolctxhead by qla2xxxprocesspurlsiocb and is still linked when the NVMe transport calls back to...

UBUNTU-CVE-2026-97566

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADDADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADDADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not te...

UBUNTU-CVE-2026-97567

In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent race between disconnect and rtx Sashiko noted that the two event can race, leading to inconsistent status. Prevent the race using the synchronous timer stop operation...

UBUNTU-CVE-2026-97986

In the Linux kernel, the following vulnerability has been resolved: virtioinput: stop callbacks before unregistering input device virtinputremove unregisters the input device before resetting the virtio device. virtinputrecvevents drops vi-lock around inputevent, so clearing vi-ready does not sto...

UBUNTU-CVE-2026-97576

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...

UBUNTU-CVE-2026-98023

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries...

UBUNTU-CVE-2026-97935

In the Linux kernel, the following vulnerability has been resolved: tracing: Set the trace clock before registering the histogram trigger histregistertrigger puts the trigger on the global namedtriggers list in cmdops-init, and only then sets the trace clock: if data-cmdops-init ret =...

UBUNTU-CVE-2026-98144

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

UBUNTU-CVE-2026-97971

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimizens takes a reference on the candidate namespace before maylistns has decided whether the caller may see it. The freensput cleanup on the denied path c...

UBUNTU-CVE-2026-97529

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

UBUNTU-CVE-2026-98118

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix readahead synchronisation issues by loading all folios upfront There are some synchronisation issues that derive from the app thread adding more folios to the rolling buffer whilst the collector thread is looking at th...

UBUNTU-CVE-2026-97580

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity computetilesuniform and computetilesnonuniform loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps writes one COLUMNWIDTH /...

UBUNTU-CVE-2026-98096

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

UBUNTU-CVE-2026-97939

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

UBUNTU-CVE-2026-98150

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPFFCPU validation for sparse CPU IDs BPFFCPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpfmapcheckopflags currently compares that ID with numpossiblecpus, which is the number of possible...

UBUNTU-CVE-2026-97573

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle buffer allocation failure in bnxtrxringreset bnxtrxringreset frees the ring buffers and then reallocates them, ignoring the result. bnxtalloconerxring can fail in bnxtalloconetpainfodata, which returns -ENOMEM on t...

UBUNTU-CVE-2026-98152

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources...

UBUNTU-CVE-2026-98058

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpfsysbpf executes the bpf2 syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose reaches closefd and filpclose, which can sleep as wel...

UBUNTU-CVE-2026-97522

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix bad accounting in mptcpsubflowpushpending If subflowpushpending errors out we should avoid updating the copied byte counters, to avoid mismatch push call later on...

UBUNTU-CVE-2026-97547

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

UBUNTU-CVE-2026-97556

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work, and drops it with cifsFileInfoput once the break has been processed...

UBUNTU-CVE-2026-97594

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory currentcheckreferpath reads olddentry-dparent without holding a reference nor a lock on it, and then dereferences it in collectdomainaccesses and in the audit record. ...

UBUNTU-CVE-2026-97596

In the Linux kernel, the following vulnerability has been resolved: ipvs: reject invalid states in connection template sync records IPVS sync receivers validate protocol states before creating or updating a connection. For connection templates, however, they only log states outside the template...

UBUNTU-CVE-2026-97597

In the Linux kernel, the following vulnerability has been resolved: ipv6: flowlabel: cap duplicate leases per socket ipv6flowlabelget allocates an ipv6flsocklist entry for every successful GET. The recheck path for a compatible existing flowlabel links another lease without applying any lease...

UBUNTU-CVE-2026-97602

In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdirpreexit flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before highthresh was cleared can then acquire the...

UBUNTU-CVE-2026-97617

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Check resizedisabled before publishing the new subbuf order ringbuffersubbuforderset stores the new order and only then walks the CPUs, returning -EBUSY if any of them has resizing disabled. A user mapped buffer has...

UBUNTU-CVE-2026-97925

In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB tickbroadcastoneshotcontrol bc = tickbroadcastdevice.evtdev;...

UBUNTU-CVE-2026-97961

In the Linux kernel, the following vulnerability has been resolved: perf/core: Allow listdel during perfeventoverflow A PMU might use perfschedcbinc and perfschedcbdec interface to get the PMU call back function pmu::schedtask invoked at schedule in and schedule out. This is achieved by walking...

UBUNTU-CVE-2026-97965

In the Linux kernel, the following vulnerability has been resolved: vxlan: initialize md in vxlanxmitone If a VXLAN device is configured with both VXLANFCOLLECTMETADATA and VXLANFGBP, and a packet is transmitted through it using an external iptunnelinfo that lacks the IPTUNNELVXLANOPTBIT flag, md...

UBUNTU-CVE-2026-98022

In the Linux kernel, the following vulnerability has been resolved: net: cap txqueuelen at S16MAX to prevent oversized ring allocations Several subsystems allocate ring buffers sized by dev-txqueuelen with no upper bound. An unprivileged user via unshare -Urn can set a huge txqueuelen and exhaust...

UBUNTU-CVE-2026-98068

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rdsconnshutdown consume a concurrent drop rdsconnshutdown finishes by moving the path from RDSCONNDISCONNECTING to RDSCONNDOWN, and also accepts RDSCONNERROR as the starting state of that final transition, so...

UBUNTU-CVE-2026-98070

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

UBUNTU-CVE-2026-98071

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

UBUNTU-CVE-2026-98078

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

UBUNTU-CVE-2026-98080

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force reloc root creation during qgroupaccountsnapshot BUG When running btrfs/252 with quota enabled through MKFSOPTIONS="-O quota", it has a high chance to trigger the following kernel warning and flips the fs RO:...

UBUNTU-CVE-2026-98082

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioclist memory leak during error There are two possible ways to leak bioc memory on btrfsorderedextent::bioclist: - An error occurred for btrfsinsertoneraidextent Then the function btrfsinsertraidextent...

UBUNTU-CVE-2026-98083

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfsinsertoneraidextent aborts and ends the transaction before returning -ENOMEM. btrfsfinishoneordered, the production...

UBUNTU-CVE-2026-98120

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix subreq ref leak Fix a subrequest ref leak in netfsunbufferedwrite in the event that subreq-ioiter ends up zero length during preparation...

UBUNTU-CVE-2026-98122

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlanmdbremotesrcdel vxlanmdbisvalidsource, which validates MDBEATTRSOURCE and every MDBEATTRSRCLIST member, accepts the all-zeros address. A source list is only accepted on a , G entry, whose...

UBUNTU-CVE-2026-98129

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

UBUNTU-CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

UBUNTU-CVE-2026-97985

In the Linux kernel, the following vulnerability has been resolved: afunix: Update last skb marker in manageoob. Fahad Alharbi reported that blocking recvMSGPEEK could hog CPU due to OOB skb. In the following cases, manageoob skips OOB skbs and returns NULL for the last recvMSGPEEK:...

UBUNTU-CVE-2026-97995

In the Linux kernel, the following vulnerability has been resolved: virtioconsole: do not free control-out buffers on remove sendcontrolmsg publishes &portdev-cpkt as the control-out virtqueue cookie. removevqs walks every virtqueue and passes leftover cookies to freebuf, which treats them as...

UBUNTU-CVE-2026-98037

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...