UBUNTU-CVE-2026-97589

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When cryptofinalizehashrequest or cryptofinalizeskcipherrequest explicitly completes a request, the doonerequest callback must return 0 to indicate successful...

UBUNTU-CVE-2026-97910

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprdplatformcompropen allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprdplatformcomprcopy derive...

UBUNTU-CVE-2026-98113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

UBUNTU-CVE-2026-97619

In the Linux kernel, the following vulnerability has been resolved: iouring/rw: end write accounting from -kicomplete Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the ioreqrwcomplete taskwork. However, only the fsnotify pa...

UBUNTU-CVE-2026-97908

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...

UBUNTU-CVE-2026-98029

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

UBUNTU-CVE-2026-97902

In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a "fs: handle freezing from multiple devices" replaced the freezeholders bitmask with per-holder counters to allow nested freezes. In the bitmask version, a th...

UBUNTU-CVE-2026-97909

In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ unireaderinit registers the shared IRQ before initializing reader-irqlock. A pending interrupt can invoke the handler while the lock is still uninitialized. Initialize the lock...

UBUNTU-CVE-2026-97609

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent UAF during module unload nfctsettimeout protects the timeout hook dereference and policy lookup with rcureadlock. cttimeoutexit, however, unregisters the per-net operations before it clears the hook...

UBUNTU-CVE-2026-97525

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Allocate split page tables as kernel page tables A PTE is allocated directly without going through the standard page table allocation routines such as ptealloconekernel when the CPA code splits a large page...

UBUNTU-CVE-2026-98011

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhfchange accepts any quantum from userspace, including 1. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times und...

UBUNTU-CVE-2026-97563

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead The SMB1 synchronous read helper CIFSSMBRead validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy...

UBUNTU-CVE-2026-98055

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Clean up the bus when fetching ML caps fails sndhdacextbusgetmlcapabilities may fail and its return code shall be checked and accounted for. Address the issue by updating the error-path for avspciprobe. At the...

UBUNTU-CVE-2026-97946

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

UBUNTU-CVE-2026-98060

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks bpfrbtreeadd keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held...

UBUNTU-CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

UBUNTU-CVE-2026-95811

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUESTURI, the...

UBUNTU-CVE-2026-92288

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndPointAuthenticationCredentials skips th...

UBUNTU-CVE-2026-92289

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint...

UBUNTU-CVE-2026-53493

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage before container start, causing long ContainerCreating stalls and, at larger sizes, node/runtime instability...

UBUNTU-CVE-2026-42394

sieve: symlink traversal flaw could result in arbitrary file disclosure...

UBUNTU-CVE-2026-88387

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parsetiffifd when processing TIFF tag 0x00fe NewSubfileType. A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts thi...

UBUNTU-CVE-2026-88386

libsndfile 1.2.2 contains a misaligned memory access issue in psfbinheaderreadf while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int and perform a 4-byte store. This results in undefined behavior leading to deni...

UBUNTU-CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

UBUNTU-CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

UBUNTU-CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

UBUNTU-CVE-2026-96749

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

UBUNTU-CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

UBUNTU-CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

UBUNTU-CVE-2026-57179

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

UBUNTU-CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

UBUNTU-CVE-2026-57176

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Ven...

UBUNTU-CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

UBUNTU-CVE-2026-97410

In the Linux kernel, the following vulnerability has been resolved: netconsole: take targetcleanuplistlock in dropnetconsoletarget dropnetconsoletarget unlinks the target while only holding targetlistlock. However, when the underlying interface has been unregistered, netconsolenetdevevent moves t...

UBUNTU-CVE-2026-97490

In the Linux kernel, the following vulnerability has been resolved: affs: handle setblocksize failures affs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

UBUNTU-CVE-2026-93809

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: flush pending RCU callbacks on module unload Call rcubarrier in module exit to wait for outstanding callrcu callbacks before freeing module text, preventing late callback execution in freed memory. BUG: unable to hand...

UBUNTU-CVE-2026-93795

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix leaks and online flag on radixtreeinsert failure When radixtreeinsert fails in blkgcreate, the error path has two issues: 1. blkg-online is set to true unconditionally, even when the blkg was never fully inserted...

UBUNTU-CVE-2026-93545

An out-of-bounds read in libXi's XListInputDevices in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

UBUNTU-CVE-2026-93782

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replac...

UBUNTU-CVE-2026-93542

An out-of-bounds read in libXi's XI2 class parsing via sizeclasses and copyclasses in libXi before 1.8.4 could be used by malicous servers to crash the X client...

UBUNTU-CVE-2026-97477

In the Linux kernel, the following vulnerability has been resolved: RDMA/counter: Fix numcounters leak on bindqp failure in allocandbind When rdmacounterbindqp fails in allocandbind, the error path jumps to errmode which frees the counter without decrementing portcounter-numcounters. The only pla...

UBUNTU-CVE-2026-93544

An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client...

UBUNTU-CVE-2026-93794

In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h...

UBUNTU-CVE-2026-93826

In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidppconnectevent If inputregisterdevice fails, we call inputfreedevice, but keep stale pointer to the old device in hidpp-input, which could potentially lead to UAF. Fix that by resetting it to...

UBUNTU-CVE-2026-93827

In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtiofssetupvqs allocates fs-vqs and fs-mqmap before calling virtiofindvqs. If virtiofindvqs fails, the error path frees both pointers and returns an error to virtiofsprobe...

UBUNTU-CVE-2026-97421

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ibumemfindbestpgsz Several corner cases, especially important on 32 bits: - umem-iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the...

UBUNTU-CVE-2026-93543

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

UBUNTU-CVE-2026-93829

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix races in cifsd thread creation The cifsd demultiplex thread can run and access tcpses before the parent thread has finished populating tcpses, which the worker thread accesses locklessly. Also, the kthreadrun mac...

UBUNTU-CVE-2026-94281

An out-of-bounds read in libXi's XListInputDevices class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

UBUNTU-CVE-2026-97521

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix quota init duplicate scan gfs2quotainit checks for duplicate quotachange IDs while holding qdlock and the quota hash bucket bitlock. That path used gfs2qdsearchbucket, which takes a lockref reference via...