UBUNTU-CVE-2026-93286

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarpsendddp aarpsendddp calls atalkfinddevaddrdev in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured dev-atalkptr == NULL,...

UBUNTU-CVE-2026-97484

In the Linux kernel, the following vulnerability has been resolved: usbip: vhcihcd: fix NULL deref in statusshowvhci platformgetdrvdata can return NULL if a VHCI host controller's probe failed e.g. due to USB bus number exhaustion. statusshowvhci checked for a NULL pdev but not for a NULL hcd...

UBUNTU-CVE-2026-93798

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reloc root cleanup in mergerelocroots If the root we got has zero root refs in its root item, we are resetting the root's -relocroot without using barriers like we do everywhere else. Sashiko complained about this whil...

UBUNTU-CVE-2026-93800

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on reloc root after error in insertdirtysubvol If during relocation we fail in insertdirtysubvol because btrfsupdaterelocroot returned an error, we will leave a root's relocroot field pointing to a reloc...

UBUNTU-CVE-2026-93806

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc response length before status and IE access cfg80211rxassocresp initialises the status and response-IE fields of cfg80211connectrespparams from the management frame before proving that the frame is...

UBUNTU-CVE-2026-93812

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix sdndr.data memory leak in ksmbdvfssetsdxattr ndrencodev4ntacl allocates sdndr.data via kzalloc at entry. If any subsequent ndrwrite call returns error during encoding, the allocated sdndr.data won't be freed and causes...

UBUNTU-CVE-2026-97434

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix handling of NAPI on the remove path All the NAPI instances for a DPSW device are attached to the first switch port's netdevice but shared by all ports. The NAPI instances get disabled only once the last port goe...

UBUNTU-CVE-2026-97441

In the Linux kernel, the following vulnerability has been resolved: ata: ahci: fail probe if BAR too small for claimed ports When an AHCI controller is disabled in BIOS, its HOSTCAP register may contain a bogus value, e.g. 0xFFFFFFFF. Since CAP.NP Number of Ports is a zeroes based 5-bit register...

UBUNTU-CVE-2026-97452

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Prevent adding invalid references Prevent adding references for local, argument, and debug objects in acpiutcopysimpleobject...

UBUNTU-CVE-2026-97506

In the Linux kernel, the following vulnerability has been resolved: crypto: ixp4xx - fix buffer chain unwind on allocation failure chainupbuffers builds a linked list of buffer descriptors for a scatterlist. If dmapoolalloc fails while constructing the list, the current code sets buf to NULL and...

UBUNTU-CVE-2026-93788

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: acpi: validate WGDS table revision index Check tblrev bounds before BITtblrev to avoid undefined shifts when firmware reports an invalid revision value...

UBUNTU-CVE-2026-97489

In the Linux kernel, the following vulnerability has been resolved: bfs: handle setblocksize failures bfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

UBUNTU-CVE-2026-97453

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate bytecount in acpipsgetnextpackagelength Validate package length reading in acpipsgetnextpackagelength...

UBUNTU-CVE-2026-97482

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: gokuudc: avoid NULL deref of dev-driver in INTUSBRESET log gokuirq handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL -driver: if...

UBUNTU-CVE-2026-97491

In the Linux kernel, the following vulnerability has been resolved: net/rds: Don't sleep inside rdsibconnpathshutdown New rds rdma self tests exposed a hang when tearing down the ib network configs. This is caused by the shutdown worker thread sleeping on the waitevent call, which blocks other wo...

UBUNTU-CVE-2026-97502

In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: avoid NULL deref of host-data in IRQ handler mmcdavinciirq returns early only when both host-cmd and host-data are NULL: if host-cmd == NULL && host-data == NULL ... return IRQNONE; So we may legitimately reach the...

UBUNTU-CVE-2026-97437

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfsdiremit and hdrfinde The bounds check in ntfsdiremit compares fname-namelen a character count against e-size a byte count without accounting for the 2-byte-per-character UTF-16LE encoding or t...

UBUNTU-CVE-2026-97520

In the Linux kernel, the following vulnerability has been resolved: gfs2: move quotainit qc iterator increment Move qc++ from the loop body into the for-loop increment expression in gfs2quotainit. This keeps iterator progression explicit and avoids mixing pointer advance with duplicate-slot...

UBUNTU-CVE-2026-97493

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry count to AMDGPUMAXI2CBUS so we do not overrun adev-i2cbus or walk an absurd number of entries on corrupt size fields...

UBUNTU-CVE-2026-97511

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds access in monitor In NAN, we don't know on what band the frame will be sent. Therefore we set info-band to NUMNL80211BANDS. However, this leads to out-of-bound access in...

UBUNTU-CVE-2026-97426

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error Return the parse error before acquiring PM access...

UBUNTU-CVE-2026-93790

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix out-of-bounds tiddata access in BA notif mvmsta-tiddata was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lqcolor into a random tiddata slot unrelated to the BA...

UBUNTU-CVE-2026-93285

In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fsgckthread in f2fssbinfo Instead of allocating f2fsgckthread dynamically, embed it in f2fssbinfo. This simplifies lifetime management and prepares for fixing race conditions during teardown. - sbistore -...

UBUNTU-CVE-2026-93791

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: add a check on the tid coming from the firmware banotif-tid is a firmware-controlled u8 that is used directly as an array index into tiddata without any validation. Add a bounds check against IWLMAXTIDCOUNT...

UBUNTU-CVE-2026-97480

In the Linux kernel, the following vulnerability has been resolved: tty: serial: 8250: protect against NULL uart-port.dev in register serial8250register8250port conditionally copies uart-port.dev from up-port.dev only when up-port.dev is non-NULL: if up-port.dev uart-port.dev = up-port.dev; ... S...

UBUNTU-CVE-2026-97478

In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd shutdown acrnirqfddeassign and the eventfd EPOLLHUP wakeup can race and free the same struct hsmirqfd: CPU0 CPU1 ---- ---- eventfdrelease wakeuppollEPOLLHUP hsmirqfdwakeup...

UBUNTU-CVE-2026-93284

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drmpagemapmigrateunmappages relies on the pages array to determine which pages require DMA unmapping. However, drmpagemapmigrationunlockputpages clears the array as pa...

UBUNTU-CVE-2026-97504

In the Linux kernel, the following vulnerability has been resolved: watchdog: lenovose10wdt: Fix use-after-free and resource leak risk Review by sashiko.dev highlighted potential use after free and resource leak instances. Set se10pdev to null to prevent use after free Remove DMI call back and...

UBUNTU-CVE-2026-93827

In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtiofssetupvqs allocates fs-vqs and fs-mqmap before calling virtiofindvqs. If virtiofindvqs fails, the error path frees both pointers and returns an error to virtiofsprobe...

UBUNTU-CVE-2026-97454

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in acpipsgetnextfield Add boundary checks in acpipsgetnextfield to prevent out-of-bounds access...

UBUNTU-CVE-2026-97443

In the Linux kernel, the following vulnerability has been resolved: perf/ftrace: Fix WARNING in unregisterftracefunction perfftracefunctionunregister unconditionally calls unregisterftracefunction without checking whether the ftraceops was ever successfully registered. This triggers a WARNON in...

UBUNTU-CVE-2026-97447

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance OEM ID and Table ID validation in acpiexloadtableop Enhance OEM ID and Table ID validation in acpiexloadtableop to prevent buffer overflows...

UBUNTU-CVE-2026-97451

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

UBUNTU-CVE-2026-88383

libical 4.0.6 contains an incompatible function pointer in icalparameterstringtokind. When parsing iCalendar data containing a parameterized property, the function passes icalparametercomparekindmap to bsearch through an incompatible comparator function pointer type. bsearch invokes the callback...

UBUNTU-CVE-2026-97500

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: phy: check length before parsing PHY status IE Hardware might report PHY status IE with unexpected length, and parser might access out of range. Check the length ahead...

UBUNTU-CVE-2026-88367

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvgcurveDivs during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division...

UBUNTU-CVE-2026-97455

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpidsterminatecontrolmethod Fix use-after-free issue in acpidsterminatecontrolmethod by clearing references to method locals and arguments...

UBUNTU-CVE-2026-97422

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and...

UBUNTU-CVE-2026-93815

In the Linux kernel, the following vulnerability has been resolved: net: au1000: move freeirq out of the close-time spinlocked section au1000close calls freeirq while aup-lock is still held with spinlockirqsave. freeirq can sleep because it takes the IRQ descriptor request mutex, so it does not...

UBUNTU-CVE-2026-93288

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: wait for rcu grace period before freeing pernet state sashiko reports: "nfnllognetexit calls nflogunset, which clears the logger pointer without an RCU grace period. Immediately after, opsfreelist frees t...

UBUNTU-CVE-2026-93545

An out-of-bounds read in libXi's XListInputDevices in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

UBUNTU-CVE-2026-97505

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add CAPSYSADMIN check to resourceresizestore Currently, the resourceresizestore allows writing to the resourceNresize sysfs attribute to change a BAR's size without checking for capabilities, currently relying only on...

UBUNTU-CVE-2026-97473

In the Linux kernel, the following vulnerability has been resolved: powercap: intelrapl: Fix memory leak in rapladdpackagecpuslocked When topologyphysicalpackageid/topologylogicaldieid returns a negative value, rapladdpackagecpuslocked returns ERRPTR-EINVAL directly without freeing the raplpackag...

UBUNTU-CVE-2026-97430

In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCDFLAGHWACCESSIBLE. HCDFLAGHWACCESSIBLE is set and cleared in suspend and resume...

UBUNTU-CVE-2026-97487

In the Linux kernel, the following vulnerability has been resolved: jfs: handle setblocksize failures jfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

UBUNTU-CVE-2026-97501

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction pinctrlgpiodirectioninput / pinctrlgpiodirectionoutput take the pinctrl mutex. This causes a gpiochip operations to need to sleep. Worse yet, the .cansleep...

UBUNTU-CVE-2026-93782

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replac...

UBUNTU-CVE-2026-88373

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

UBUNTU-CVE-2026-94281

An out-of-bounds read in libXi's XListInputDevices class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

UBUNTU-CVE-2026-93255

In the Linux kernel, the following vulnerability has been resolved: btrfs: make sure EXTENTBUFFERREADING is cleared under refslock FALSE ALERTS There is a bug report that the warning inside invalidateandcheckbtreefolios got triggered during btrfs/298: BTRFS info device sdd: first mount of...