UBUNTU-CVE-2026-89768

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backingfileopen derives the path to be stored in the new backing file from userfile-fpath. This is incorrect when userfile itself is a backing file, which is the case for nested stacking...

UBUNTU-CVE-2026-89738

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle: at91vbustimer schedules vbustimerwork, and at91vbustimerwork calls...

UBUNTU-CVE-2026-89749

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...

UBUNTU-CVE-2026-89727

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID vgicv2deactivate passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq, and treats a failed lookup as a "can't happen" condition with WARNONONCE. The gues...

UBUNTU-CVE-2026-89771

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...

UBUNTU-CVE-2026-89730

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in alteracvpsendblock dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

UBUNTU-CVE-2026-89682

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcachedisposal UAF by inlining dispose state into nfsdnet nfsdfiledisposelistdelayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing...

UBUNTU-CVE-2026-89611

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

UBUNTU-CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

UBUNTU-CVE-2026-89441

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

UBUNTU-CVE-2026-89437

In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sarprobe The memory allocated for devicemodeinfo in parsepackage called by sargetdata is not freed in some of the error paths in sarprobe. Fix that by converting to use device...

UBUNTU-CVE-2026-89514

In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Use GFPATOMIC for VLAN alloc under spinlock fnicfcoeprocessvlanresp allocates a VLAN descriptor with kzallocobj default GFPKERNEL while holding vlanslock via spinlockirqsave. GFPKERNEL may sleep, which is not allowed ...

UBUNTU-CVE-2026-89717

In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zramdestroycomps Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported 1 a couple of zram issues: a possible BUGON in zlib code due to missing winbits rang...

UBUNTU-CVE-2026-89516

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't BUGON a destroyed DSQ in processdeferredreenqusers scxbpfdsqreenq queues a deferred reenq dru that runs from rundeferred, not ops.dispatch. If the DSQ is destroyed before the dru runs, processdeferredreenqusers se...

UBUNTU-CVE-2026-89519

In the Linux kernel, the following vulnerability has been resolved: schedext: Replace SCXRQBALKEEP with a dispatch verdict return SCXRQBALKEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while...

UBUNTU-CVE-2026-89566

In the Linux kernel, the following vulnerability has been resolved: jbd2: check needresched when skipping busy checkpoint buffers journalshrinkonecplist skips busy checkpoint buffers when called with JBD2SHRINKBUSYSKIP. The continue statement on this path also skips the needresched check at the e...

UBUNTU-CVE-2026-89570

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

UBUNTU-CVE-2026-89523

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

UBUNTU-CVE-2026-80998

In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr-kickpending = 1. The normal TX path handles this, but the SW USO...

UBUNTU-CVE-2026-89518

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix thisrq assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch may execute on a CPU different from the dispatched rq's. Several...

UBUNTU-CVE-2026-89492

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2validatedxleaf and ocfs2validatedxroot check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validato...

UBUNTU-CVE-2026-89630

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

UBUNTU-CVE-2026-89455

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown pldapcieirqdomaindeinit removes pcie-eventdomain via irqdomainremove, but the per-event IRQs mapped from that domain are requested with devmrequestirq in...

UBUNTU-CVE-2026-89486

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmdrcvr in ipmidestroyuser Commit 9e91f8a6c868 "ipmi:msghandler: Remove srcu for the ipmiinterfaces list" dropped the synchronizercu between unlinking the command receivers from intf-cmdrcvrs and freei...

UBUNTU-CVE-2026-89499

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

UBUNTU-CVE-2026-89680

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: label where releasecopyfiles would drop the nfdst reference taken by...

UBUNTU-CVE-2026-89658

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40cleanadminrevoked takes a stateid reference under clp-cllock, drops nn-clientlock, and calls nfsd4droprevokedstid, which dereferences the stateid's...

UBUNTU-CVE-2026-89683

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsdsetfhdentry leaks the dentry reference from exportfsdecodefhraw when the NFS3FHSIZE or NFSFHSIZE switch cases detect NFSEXPV4ROOT and goto out. The out: label calls...

UBUNTU-CVE-2026-89454

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix IRQ domain leaks in the error paths of pldainitinterrupts pldainitinterrupts initializes IRQ domains and creates IRQ mapping but does not unwind them when later step fails. If platformgetirq or either...

UBUNTU-CVE-2026-89534

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sccmid when ADDRCHANGE replacement fails When svcrdmalistenhandler handles RDMACMEVENTADDRCHANGE, it creates a replacement listener cmid and returns 1, telling the CM core to destroy the old one. If the replacement...

UBUNTU-CVE-2026-80962

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cacheinfo cachesegsinit iterates cacheinfo-nsegs times indexing cache-segments, which is sized to the cache device geometry, and getsegid takes each segment id from the on-media...

UBUNTU-CVE-2026-89675

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

UBUNTU-CVE-2026-89577

In the Linux kernel, the following vulnerability has been resolved: dm-io: report non-retryable errors separatedly The error codes BLKSTSNOTSUPP and BLKSTSINVAL should not cause leg failure on dm-raid1. This patch changes the interface to dm-io, so that it reports two error bitmaps - errorbits an...

UBUNTU-CVE-2026-81012

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

UBUNTU-CVE-2026-89465

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwrrdywork, maxchargingtimework and battpresencework. pwrrdywork and battpresencework can also queue maxchargingtimework, while...

UBUNTU-CVE-2026-80999

In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: use gpiodsetvaluecansleep for reset GPIO rtl83xxresetassert and rtl83xxresetdeassert are only called from the probe path, which may sleep and is not timing-critical. When the reset GPIO is provided by a sleepin...

UBUNTU-CVE-2026-89678

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsddirectwrite nfsddirectwrite walks a list of write segments and, after each vfsiocbiterwrite, tries to detect a short write so the loop can stop before placing the next segment at a wrong...

UBUNTU-CVE-2026-89629

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

UBUNTU-CVE-2026-89484

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclntlocksinitprivate installs NLM file lock operations even when nlmclntfindlockowner fails to allocate a lockowner. nlmclntproc then returns -ENOMEM, but the VFS sti...

UBUNTU-CVE-2026-81006

In the Linux kernel, the following vulnerability has been resolved: ipmi: Remove all sysfs files on registration failure ipmiaddsmi creates the nrusers and nrmsgs files before trying to create the maintenancemode file. If that last creation fails, the error path removes only nrusers before droppi...

UBUNTU-CVE-2026-89639

In the Linux kernel, the following vulnerability has been resolved: cifs: use cifsinvalidatecache in cifsdotruncate for OTRUNC cifsdotruncate is invoked from cifsopen without irwsem, so it cannot use cifsresizefilelocked to perform a proper fscache cookie resize. Instead, add cifsinvalidatecache...

UBUNTU-CVE-2026-89556

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...

UBUNTU-CVE-2026-89593

In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, unmaphugepagerange can adjust reservations. In the case of folio mapped in both a parent and a child, if the parent unmaps the range first, th...

UBUNTU-CVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

UBUNTU-CVE-2026-89716

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits value is outside of valid ranges...

UBUNTU-CVE-2026-89600

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotifyprecontent builds its filerange on the triggering task's stack. fanotifyallocpermevent saves a pointer to range.pos in the heap-allocated permission event so...

UBUNTU-CVE-2026-89472

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs chargermanagerremove and the errregextcon probe error path free each charger regulator with regulatorput before tearing down the powersupply sysfs entries...

UBUNTU-CVE-2026-89651

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...

UBUNTU-CVE-2026-89546

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

UBUNTU-CVE-2026-89610

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a...