UBUNTU-CVE-2026-97596

In the Linux kernel, the following vulnerability has been resolved: ipvs: reject invalid states in connection template sync records IPVS sync receivers validate protocol states before creating or updating a connection. For connection templates, however, they only log states outside the template...

UBUNTU-CVE-2026-97568

In the Linux kernel, the following vulnerability has been resolved: mptcp: syncookies: remember the request backup flag Instead of using an uninitialised bit when copying the info in subflowulpclone. To fix this, no need to extend the joinentry structure: backup is coming from struct...

UBUNTU-CVE-2026-97608

In the Linux kernel, the following vulnerability has been resolved: netfilter: nflog: unregister loggers before per-net teardown nflogsyslog and nfnetlinklog unregister their per-network namespace operations before unregistering their global logger backends. This leaves a window where a sysctl or...

UBUNTU-CVE-2026-98027

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

UBUNTU-CVE-2026-98052

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

UBUNTU-CVE-2026-98057

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nrsubbufs to persistent ring buffer validation Sashiko reported that the code was using meta-nrsubbufs without making sure that it matched the nrpages + 1 on data that was assuming the two were the same...

UBUNTU-CVE-2026-97603

In the Linux kernel, the following vulnerability has been resolved: idpf: disable DIM work before freeing qvectors idpf never drains the Tx/Rx DIM works before freeing the memory they live in. txdim and rxdim are embedded in struct idpfqvector, they are queued from the NAPI poll via netdim, and...

UBUNTU-CVE-2026-97522

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix bad accounting in mptcpsubflowpushpending If subflowpushpending errors out we should avoid updating the copied byte counters, to avoid mismatch push call later on...

UBUNTU-CVE-2026-97524

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive path can recursively call mptcpdataready via state change under unlucky error conditions, and then try to hold the data lock again. Break the...

UBUNTU-CVE-2026-97525

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Allocate split page tables as kernel page tables A PTE is allocated directly without going through the standard page table allocation routines such as ptealloconekernel when the CPA code splits a large page...

UBUNTU-CVE-2026-97528

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qlanvmexmtlsrsp obtains uctx, which was linked into fcport-unsolctxhead by qla2xxxprocesspurlsiocb and is still linked when the NVMe transport calls back to...

UBUNTU-CVE-2026-97529

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

UBUNTU-CVE-2026-97533

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm read lock on attribute changes to avoid UAF A previous commit protected against races between ptdump and CPA collapse, however one still exists between attribute changes and collapse as reported by Deni...

UBUNTU-CVE-2026-97534

In the Linux kernel, the following vulnerability has been resolved: f2fs: accurately adjust freesections during freesegmentrange In freesegmentrange, MAINSECSsbi is temporarily reduced by secs to restrict block allocation to the safe remaining main area while valid blocks in the truncated range a...

UBUNTU-CVE-2026-97537

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

UBUNTU-CVE-2026-97540

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that...

UBUNTU-CVE-2026-97545

In the Linux kernel, the following vulnerability has been resolved: xfs: don't leak newbp if xfsbtreebloaddropbuf fails LOLLM observes that in xfsbtreebloadprepblock, xfsbtreebloaddropbuf can hit an IO error if writing the delwri buffer list to disk fails. In this case, we fail to release newbp,...

UBUNTU-CVE-2026-97549

In the Linux kernel, the following vulnerability has been resolved: xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on XFS for-next as of 7.3-rc2 with MKFSOPTIONS="-n size=8192", I observed the following trimmed dmesg splat: XFS: Assertion failed: args-total =...

UBUNTU-CVE-2026-97551

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...

UBUNTU-CVE-2026-97552

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise error in xfsdeferfinishone xfsdeferfinishone declares error without an initialiser and only assigns it inside the loop over dfp-dfpwork. When that list is empty the loop body never runs, control falls through to t...

UBUNTU-CVE-2026-97553

In the Linux kernel, the following vulnerability has been resolved: xfs: lock the healthmon when inserting unmount event LOLLM complains that xfshealthmonunmount does an unlocked insert of the unmount event into the health monitor's event list. Fix that...

UBUNTU-CVE-2026-97554

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifsposixtofattr cifsposixtofattr ignores the return value of posixinfoparse. When a malformed POSIX directory entry is encountered e.g. invalid SID lengths from an untrusted server,...

UBUNTU-CVE-2026-97555

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

UBUNTU-CVE-2026-97560

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

UBUNTU-CVE-2026-97610

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix uninitialized return value in netfsunbufferedwrite If preparation of the first subrequest fails, netfsunbufferedwrite exits its loop before ret is initialized. The empty-iterator check can do the same. For synchronous...

UBUNTU-CVE-2026-97899

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leak in queryperfconfiglist When krealloc fails, free the original oaconfigids before returning to avoid a memory leak. cherry picked from commit 9977e9d84f46d4f12ad35fbbc0ec4638554bce87...

UBUNTU-CVE-2026-98018

In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctpi3cprobe drops busdevslock after finding the matching bus. A concurrent I3CNOTIFYBUSREMOVE can then unregister and free the bus netdev before probe passes its private data to...

UBUNTU-CVE-2026-98092

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: yc: fix memory leak in acp6xpdmdmaclose acp6xpdmdmaclose does not free the runtime-privatedata buffer allocated in acp6xpdmdmaopen. Add the missing kfree...

UBUNTU-CVE-2026-98121

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

UBUNTU-CVE-2026-97550

In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards -- xfsbufinvallogspace's second parameter is supposed to be in bytes, but maxbinval is i...

UBUNTU-CVE-2026-97573

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle buffer allocation failure in bnxtrxringreset bnxtrxringreset frees the ring buffers and then reallocates them, ignoring the result. bnxtalloconerxring can fail in bnxtalloconetpainfodata, which returns -ENOMEM on t...

UBUNTU-CVE-2026-97588

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly When hardware persistently returns -EBUSY after exhausting retries, the error propagates to cryptofinalizerequest. The crypto API's completion wrapper treats -EBU...

UBUNTU-CVE-2026-98078

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

UBUNTU-CVE-2026-97585

In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afseditdirremove to use a cleanup function to unmap the block pointed to by afsdiriter::block if it's left pointing to something rather than manually kunmapping the blocks. Manually...

UBUNTU-CVE-2026-97900

In the Linux kernel, the following vulnerability has been resolved: drm/drmexec: fix up contended obj when numobjects is 0 drmexecpreparearray silently returns success without calling drmexeclockcontended when numobjects is zero. This breaks the invariant upheld by drmexeclockobj, where every ent...

UBUNTU-CVE-2026-98007

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg lets a pointer-valued R1 reach the helper-specif...

UBUNTU-CVE-2026-98035

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields when recycling rhtab elements rhtabmapupdateexisting and rhtabdeleteelem call bpfobjfreefields when replacing or deleting a value. These map operations can run from BPF programs in NMI context, where...

UBUNTU-CVE-2026-98061

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls preparefuncexit for the taken branch. When the current frame i...

UBUNTU-CVE-2026-98110

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

UBUNTU-CVE-2026-97989

In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vdusevalidateconfig only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap. The split-ring helpers use align - 1 as a bit mask, so the alignment must...

UBUNTU-CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

UBUNTU-CVE-2026-97995

In the Linux kernel, the following vulnerability has been resolved: virtioconsole: do not free control-out buffers on remove sendcontrolmsg publishes &portdev-cpkt as the control-out virtqueue cookie. removevqs walks every virtqueue and passes leftover cookies to freebuf, which treats them as...

UBUNTU-CVE-2026-97996

In the Linux kernel, the following vulnerability has been resolved: virtio: fix use-after-free in unregistervirtiodevice deviceunregister is devicedel plus putdevice. When the caller holds no extra reference, that drops the last one and runs the release callback, which for several transports free...

UBUNTU-CVE-2026-97998

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 - 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspac...

UBUNTU-CVE-2026-98001

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize onl...

UBUNTU-CVE-2026-97536

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-X handler qla2xxxmsixrspq schedules qladowork via queueworkha-wq, &qpair-qwork. qladowork dereferences the qpair vha, rsp and takes...

UBUNTU-CVE-2026-97935

In the Linux kernel, the following vulnerability has been resolved: tracing: Set the trace clock before registering the histogram trigger histregistertrigger puts the trigger on the global namedtriggers list in cmdops-init, and only then sets the trace clock: if data-cmdops-init ret =...

UBUNTU-CVE-2026-97562

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after iteratesuperstype has dropped sumount and its passive reference. Concurrent...

UBUNTU-CVE-2026-97564

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

UBUNTU-CVE-2026-97565

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead CIFSSMBRead reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The...