62037 matches found
UBUNTU-CVE-2026-80785
In the Linux kernel, the following vulnerability has been resolved: fbdev: serialize mode sysfs access with lockfbinfo showmode, showmodes, and storemode access fbinfo-modelist and fbinfo-mode without holding lockfbinfo. storemodes takes lockfbinfo while replacing the modelist and freeing the old...
UBUNTU-CVE-2026-80789
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...
UBUNTU-CVE-2026-80769
In the Linux kernel, the following vulnerability has been resolved: HID: rapoo: fix missing hidisusb check tousbinterface can only be used on a hiddevice whose parent is really USB; uhid can create devices that identify as being on BUSUSB, but don't actually have a USB parent. Fix the use of...
UBUNTU-CVE-2026-80833
In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Remove cryptorng interface Since the cryptorng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go...
UBUNTU-CVE-2026-80834
In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Remove cryptorng interface Since the cryptorng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go...
UBUNTU-CVE-2026-80858
In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuseuringcreatequeue initializes a fuseringqueue and then publishes the pointer into ring-queuesqid with WRITEONCE under the fch-lock. There are several readers that may...
UBUNTU-CVE-2026-80853
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...
UBUNTU-CVE-2026-80827
In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...
UBUNTU-CVE-2026-80848
In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race condition during close for espintcp sockets: espintcpclose frees emsg-skb via kfreeskb without holding any socket lock. Concurrently, the xfrmtransreinject wor...
UBUNTU-CVE-2026-80783
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unbounded recursion in magicmouserawevent magicmouserawevent handles DOUBLEREPORTID 0xf7 packets, which pack two touch reports into one, by splitting the packet and calling itself on each half. The only...
UBUNTU-CVE-2026-80797
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: purge fragmented skbs during cleanup pn53xcommonclean purges respq before freeing the common PN533 state, but it leaves fragmentskb untouched. The fragmentation helpers queue transmit fragments there while sending lar...
UBUNTU-CVE-2026-80828
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usbaudioresume jumps to errout when sndusbpcmresume or sndusbmixerresume fails. The error path skips th...
UBUNTU-CVE-2026-80764
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...
UBUNTU-CVE-2026-80762
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...
UBUNTU-CVE-2026-80759
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciaml: validate firmware segment lengths amldownloadfirmware reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or...
UBUNTU-CVE-2026-80784
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix memory leak from alloc-during-teardown race mptcppmdestroy empties msk-pm.annolist and msk-pm.userspacepmlocaladdrlist under msk-pm.lock during socket teardown, dropping the lock between the two. A concurrent...
UBUNTU-CVE-2026-80822
In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: Add null check for devmkasprintf Add a check to see if devmkasprintf is not NULL in mchpipcgetclusteraggrirq, returning -ENOMEM if the function failed...
UBUNTU-CVE-2026-80795
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...
UBUNTU-CVE-2026-80842
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. That is the teardown handshake:...
UBUNTU-CVE-2026-80861
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhcigensetup locates the operational registers using the capability length read from the very first register: xhci-opregs = hcd-regs +...
UBUNTU-CVE-2026-80860
In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 "fuse: clear intrentry in fuseresend and fuseremovependingreq" the WARNON!listempty&req-intrentry in fuserequestfree still triggers due to the following race: ...
UBUNTU-CVE-2026-80804
In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...
UBUNTU-CVE-2026-80786
In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...
UBUNTU-CVE-2026-80793
In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ipdofragment ipdofragment subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ipfragnext. If the effective MTU is smaller than hlen + 8, ipfragnext round...
UBUNTU-CVE-2026-80792
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...
UBUNTU-CVE-2026-80774
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hidisusb check tousbinterface can only be used on a hiddevice whose parent is really USB; uhid can create devices that identify as being on BUSUSB, but don't actually have a USB parent. Fix the use of...
UBUNTU-CVE-2026-80841
In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmallo...
UBUNTU-CVE-2026-80836
In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtiocryptodataqakciphercallback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the origin...
UBUNTU-CVE-2026-80803
In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSFRES length to the destination buffer digitalinrecvsensfres memcpys resp-len bytes from a remote NFC-F device response into the NFCSENSFRESMAXSIZE-byte target.sensfres field without an upper-bound check. A...
UBUNTU-CVE-2026-80844
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6rearrangerthdr assumes that segmentsleft is not larger than the number of addresses described by t...
UBUNTU-CVE-2026-80790
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: fix invalid free in LS IOD error path nvmetfcalloclsiodlist advances iod while initializing the LS IOD array. If an rqstbuf allocation or response buffer DMA mapping fails, the unwind loop decrements iod past the start ...
UBUNTU-CVE-2026-80855
In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on open OTRUNC DAX failure fuseopen takes filemapinvalidatelock for a DAX truncate daxtruncate = true and releases it before the outinodeunlock label. But when fusedaxbreaklayouts fails, the goto...
UBUNTU-CVE-2026-80760
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...
UBUNTU-CVE-2026-80819
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...
UBUNTU-CVE-2026-80775
In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm-futex.phash.ref allocation futexhashallocate allocates mm-futex.phash.ref without any locking. Commit d9b05321e21e "futex: Move futexhashfree back to mmput" moved the allocation here and assumed...
UBUNTU-CVE-2026-80864
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IBQPMAXDESTRDATOMIC modifyqp rxeqpfromattr handles IBQPMAXDESTRDATOMIC outside the IBQPSTATE path, so it holds no statelock and runs while the responder task rxereceiver recvtask on rxewq is live. A...
UBUNTU-CVE-2026-80807
In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...
UBUNTU-CVE-2026-80826
In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00addisourb When TD creation fails for the last packet of an isochronous URB, c67x00addisourb gives the URB back before updating the endpoint scheduling state. c67x00givebackurb frees the UR...
UBUNTU-CVE-2026-80854
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: keep port count until LUN teardown completes tcmusbgdropnexus permits session removal once tpgportcount reaches zero. However, usbgportunlink currently decrements that count from the fabricpreunlink callback,...
UBUNTU-CVE-2026-80849
In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of currentkey on reconnect to another peer tcpinboundaohash is called before bhlocksocknested is taken, with only rcureadlock held. On the fast path for established sockets, if the rnextkeyid sent b...
UBUNTU-CVE-2026-80776
In the Linux kernel, the following vulnerability has been resolved: futex: Fix race in futexpivotpending during private hash resize A task performing a custom private hash resize can remain blocked in uninterruptible sleep indefinitely. The hung-task detector reports: INFO: task futex-resizer:314...
UBUNTU-CVE-2026-80847
In the Linux kernel, the following vulnerability has been resolved: tcp: clamp route advmss to TCPMINMSS tcpselectinitialwindow assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate that assumption. A too-small explicit RTAXADVMSS is one way to get...
UBUNTU-CVE-2026-80800
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...
UBUNTU-CVE-2026-80821
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on createcq mapping failure nvmetpciepfcreatecq calls nvmetcqcreate, which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or...
UBUNTU-CVE-2026-80811
In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...
UBUNTU-CVE-2026-85522
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/clustermigrateslots.c of the component Slot Migration. The manipulation of the argument jobname results in out-of-bounds read. The attack can be...
UBUNTU-CVE-2026-85534
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progres...
UBUNTU-CVE-2026-81666
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...
UBUNTU-CVE-2026-85197
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...