UBUNTU-CVE-2026-97451

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

UBUNTU-CVE-2026-93804

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ibss: wait for in-flight TX on disconnect While leaving an IBSS in ieee80211ibssdisconnect mac80211 flushes stations, turns the carrier off and immediately tells the driver to leave as well. While there may be...

UBUNTU-CVE-2026-97482

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: gokuudc: avoid NULL deref of dev-driver in INTUSBRESET log gokuirq handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL -driver: if...

UBUNTU-CVE-2026-97474

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: purge async notifications upon nic error This fixes a kernel panic in reconfig failure: 1. we have a BSS connection 2. we have a NAN connection 3. FW error occurs 4. reconfig restores the BSS connection 5...

UBUNTU-CVE-2026-93800

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on reloc root after error in insertdirtysubvol If during relocation we fail in insertdirtysubvol because btrfsupdaterelocroot returned an error, we will leave a root's relocroot field pointing to a reloc...

UBUNTU-CVE-2026-93805

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

UBUNTU-CVE-2026-93799

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate staid in BA window status notif BAWINDOWSTATUSNOTIFICATIONID extracts a 5-bit staid from the firmware notification and uses it to index fwidtomacid without bounds checking. Validate staid before array...

UBUNTU-CVE-2026-97476

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

UBUNTU-CVE-2026-93828

In the Linux kernel, the following vulnerability has been resolved: exfat: fix handling of damaged volume in exfatcreateupcasetable When the size of the upcase table is set to zero in the dentry for any reasone.g. corrupted media or misbehaving device, an integer overflow causes the module to loo...

UBUNTU-CVE-2026-88373

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

UBUNTU-CVE-2026-97422

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and...

UBUNTU-CVE-2026-93288

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: wait for rcu grace period before freeing pernet state sashiko reports: "nfnllognetexit calls nflogunset, which clears the logger pointer without an RCU grace period. Immediately after, opsfreelist frees t...

UBUNTU-CVE-2026-93817

In the Linux kernel, the following vulnerability has been resolved: perf: Fix addrfilterranges lifetime Lee Jia Jie reported that since event::addrfilterranges is used under RCU, it should be RCU freed...

UBUNTU-CVE-2026-97454

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in acpipsgetnextfield Add boundary checks in acpipsgetnextfield to prevent out-of-bounds access...

UBUNTU-CVE-2026-97503

In the Linux kernel, the following vulnerability has been resolved: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers /proc/irq// directory names are built in char name10 buffers with sprintfname, "%u", irq. Ten-digit IRQ numbers already need 11 bytes including the traili...

UBUNTU-CVE-2026-93787

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

UBUNTU-CVE-2026-97423

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Validate partition index before array access constructregion reads cxled-part and uses it to index cxlds-part without checking for a negative value. If the partition was never resolved, part remains at its initial val...

UBUNTU-CVE-2026-93543

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

UBUNTU-CVE-2026-94281

An out-of-bounds read in libXi's XListInputDevices class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

UBUNTU-CVE-2026-93542

An out-of-bounds read in libXi's XI2 class parsing via sizeclasses and copyclasses in libXi before 1.8.4 could be used by malicous servers to crash the X client...

UBUNTU-CVE-2026-93545

An out-of-bounds read in libXi's XListInputDevices in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

UBUNTU-CVE-2026-97494

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw Change pspcopyfw from void to int: return -ENODEV when drmdeventer fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Repla...

UBUNTU-CVE-2026-93796

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX pointers after free When iwlpcietxinit fails after RX init, nic init unwinds via iwlpcierxfree. The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touc...

UBUNTU-CVE-2026-97419

In the Linux kernel, the following vulnerability has been resolved: hsr: broadcast netlink notifications in the device's net namespace The HSR generic netlink family sets .netnsok = true. HSR devices can live in network namespaces other than initnet. Two async notifiers broadcast events with...

UBUNTU-CVE-2026-97488

In the Linux kernel, the following vulnerability has been resolved: qnx4: handle setblocksize failures qnx4 uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

UBUNTU-CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

UBUNTU-CVE-2026-97481

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix possible ISR soft lockup There are rare cases in which the host gets stuck in the ISR because it is flooded with messages during the startup phase. The reason for the soft lockup in the ISR is the missing FIFO...

UBUNTU-CVE-2026-97439

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: preserve non-DOS attribute bits in system.dosattrib BUG A corrupted ntfs3 image can hit a NULL function pointer call in genericperformwrite after toggling system.ntfsattrib and then overwriting system.dosattrib on the...

UBUNTU-CVE-2026-93803

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

UBUNTU-CVE-2026-97432

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix P2P-Device binding handling Our binding handling for P2P-Device can run into the following scenario, as observed by our testing: - a station interface is connected on some channel - the P2P-Device does a...

UBUNTU-CVE-2026-97441

In the Linux kernel, the following vulnerability has been resolved: ata: ahci: fail probe if BAR too small for claimed ports When an AHCI controller is disabled in BIOS, its HOSTCAP register may contain a bogus value, e.g. 0xFFFFFFFF. Since CAP.NP Number of Ports is a zeroes based 5-bit register...

UBUNTU-CVE-2026-97424

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: add rassuspend callback and use it for cpeccerrorirq cpeccerrorirq is acquired in amdgpugfxraslateinit but released in gfxv90hwfini, so the put site has to query amdgpuirqenabled because the get is skipped on SR-I...

UBUNTU-CVE-2026-88378

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JSReadFunctionTag...

UBUNTU-CVE-2026-88367

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvgcurveDivs during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division...

UBUNTU-CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

UBUNTU-CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

UBUNTU-CVE-2026-97417

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: use getunalignedbe32 in tcpsack The timestamp-only fast path dereferences the option stream as be32 ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use getunalignedbe32...

UBUNTU-CVE-2026-97487

In the Linux kernel, the following vulnerability has been resolved: jfs: handle setblocksize failures jfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

UBUNTU-CVE-2026-97435

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: flower: reject cross-chip redirect dsaportfromnetdev may return a valid port from a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port, or ...

UBUNTU-CVE-2026-93822

In the Linux kernel, the following vulnerability has been resolved: PCI: iproc: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead ...

UBUNTU-CVE-2026-97430

In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCDFLAGHWACCESSIBLE. HCDFLAGHWACCESSIBLE is set and cleared in suspend and resume...

UBUNTU-CVE-2026-97438

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate index entry key bounds BUG A malformed NTFS directory index entry can advertise a keysize larger than the bytes actually present in its NTFSDE payload. Directory lookup then passes that malformed key to...

UBUNTU-CVE-2026-97443

In the Linux kernel, the following vulnerability has been resolved: perf/ftrace: Fix WARNING in unregisterftracefunction perfftracefunctionunregister unconditionally calls unregisterftracefunction without checking whether the ftraceops was ever successfully registered. This triggers a WARNON in...

UBUNTU-CVE-2026-97455

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpidsterminatecontrolmethod Fix use-after-free issue in acpidsterminatecontrolmethod by clearing references to method locals and arguments...

UBUNTU-CVE-2026-97509

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep XDomain reference during the lifetime of a service This is needed because we release the service ID in tbservicerelease and the ID array is owned by the parent XDomain...

UBUNTU-CVE-2026-97407

In the Linux kernel, the following vulnerability has been resolved: ASoC: rockchip: rockchippdm: Handle runtime PM resume failures in setfmt rockchippdmsetfmt calls pmruntimegetsync before accessing hardware registers, but ignores its return value. If the runtime resume fails, the function...

UBUNTU-CVE-2026-97472

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: fix temp address generation after prefix deprecation When a router temporarily deprecates an IPv6 prefix either by sending a Router Advertisement with Preferred Lifetime = 0 or by letting the lifetime expire and...

UBUNTU-CVE-2026-97450

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

UBUNTU-CVE-2026-97453

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate bytecount in acpipsgetnextpackagelength Validate package length reading in acpipsgetnextpackagelength...

UBUNTU-CVE-2026-97446

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpinscustompackage acpinscustompackage unconditionally dereferences the first element of the package to read the BIX version number, without checking for NULL: if Elements-Common.Type !=...