{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-headers-7.0.0-31-generic", "linux-image-7.0.0-31-generic", "linux-modules-7.0.0-31-generic", "linux-riscv-7.0-headers-7.0.0-31", "linux-riscv-7.0-tools-7.0.0-31", "linux-tools-7.0.0-31-generic" ], "removed": [ "linux-headers-7.0.0-28-generic", "linux-image-7.0.0-28-generic", "linux-modules-7.0.0-28-generic", "linux-riscv-7.0-headers-7.0.0-28", "linux-riscv-7.0-tools-7.0.0-28", "linux-tools-7.0.0-28-generic" ], "diff": [ "base-files", "bind9-dnsutils", "bind9-host", "bind9-libs:riscv64", "bsdextrautils", "bsdutils", "coreutils", "cpio", "diffutils", "dirmngr", "eject", "fdisk", "gnupg", "gnupg-l10n", "gnupg-utils", "gpg", "gpg-agent", "gpg-wks-client", "gpgconf", "gpgsm", "gpgv", "keyboxd", "libattr1:riscv64", "libblkid1:riscv64", "libbz2-1.0:riscv64", "libc-bin", "libc-dev-bin", "libc-devtools", "libc6:riscv64", "libc6-dev:riscv64", "libevent-core-2.1-7t64:riscv64", "libfdisk1:riscv64", "libgcrypt20:riscv64", "libheif-plugin-aomdec:riscv64", "libheif-plugin-aomenc:riscv64", "libheif1:riscv64", "libmount1:riscv64", "libncurses6:riscv64", "libncursesw6:riscv64", "libp11-kit0:riscv64", "libpam-modules:riscv64", "libpam-modules-bin", "libpam-runtime", "libpam0g:riscv64", "libperl5.38t64:riscv64", "libpython3.12-minimal:riscv64", "libpython3.12-stdlib:riscv64", "libpython3.12t64:riscv64", "libsmartcols1:riscv64", "libssh-4:riscv64", "libtinfo6:riscv64", "libudisks2-0:riscv64", "libuuid1:riscv64", "linux-headers-generic", "linux-headers-virtual", "linux-image-virtual", "linux-libc-dev:riscv64", "linux-tools-common", "linux-virtual", "locales", "motd-news-config", "mount", "ncurses-base", "ncurses-bin", "ncurses-term", "openssh-client", "openssh-server", "openssh-sftp-server", "perl", "perl-base", "perl-modules-5.38", "python-apt-common", "python3-apt", "python3-distupgrade", "python3-pyasn1", "python3.12", "python3.12-minimal", "ubuntu-release-upgrader-core", "udisks2", "util-linux", "uuid-runtime", "wireless-regdb", "zlib1g:riscv64" ] } }, "diff": { "deb": [ { "name": "base-files", "from_version": { "source_package_name": "base-files", "source_package_version": "13ubuntu10.4", "version": "13ubuntu10.4" }, "to_version": { "source_package_name": "base-files", "source_package_version": "13ubuntu10.5", "version": "13ubuntu10.5" }, "cves": [], "launchpad_bugs_fixed": [ 2166604 ], "changes": [ { "cves": [], "log": [ "", " * /etc/issue{,.net}, /etc/{lsb,os}-release: bump version to 24.04.5", " (LP: #2166604)", "" ], "package": "base-files", "version": "13ubuntu10.5", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2166604 ], "author": "Graham Inggs ", "date": "Sun, 06 Sep 2026 14:29:43 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-dnsutils", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.6", "version": "1:9.18.39-0ubuntu0.24.04.6" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.7", "version": "1:9.18.39-0ubuntu0.24.04.7" }, "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3", " both present", " - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could", " find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,", " lib/dns/resolver.c, lib/ns/query.c.", " - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname", " mismatch in", " bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,", " bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,", " bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests", " /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_", " runtime_check.py.", " - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,", " bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/", " system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-13204", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.24.04.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 27 Aug 2026 10:10:14 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-host", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.6", "version": "1:9.18.39-0ubuntu0.24.04.6" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.7", "version": "1:9.18.39-0ubuntu0.24.04.7" }, "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3", " both present", " - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could", " find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,", " lib/dns/resolver.c, lib/ns/query.c.", " - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname", " mismatch in", " bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,", " bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,", " bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests", " /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_", " runtime_check.py.", " - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,", " bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/", " system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-13204", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.24.04.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 27 Aug 2026 10:10:14 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-libs:riscv64", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.6", "version": "1:9.18.39-0ubuntu0.24.04.6" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.7", "version": "1:9.18.39-0ubuntu0.24.04.7" }, "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3", " both present", " - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could", " find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,", " lib/dns/resolver.c, lib/ns/query.c.", " - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname", " mismatch in", " bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,", " bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,", " bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests", " /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_", " runtime_check.py.", " - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,", " bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/", " system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-13204", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.24.04.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 27 Aug 2026 10:10:14 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bsdextrautils", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bsdutils", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "1:2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "1:2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "coreutils", "from_version": { "source_package_name": "coreutils", "source_package_version": "9.4-3ubuntu6.2", "version": "9.4-3ubuntu6.2" }, "to_version": { "source_package_name": "coreutils", "source_package_version": "9.4-3ubuntu6.3", "version": "9.4-3ubuntu6.3" }, "cves": [ { "cve": "CVE-2025-5278", "url": "https://ubuntu.com/security/CVE-2025-5278", "cve_description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "cve_priority": "low", "cve_public_date": "2025-05-27 21:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-5278", "url": "https://ubuntu.com/security/CVE-2025-5278", "cve_description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "cve_priority": "low", "cve_public_date": "2025-05-27 21:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: out-of-bounds read in sort", " - debian/patches/CVE-2025-5278.patch: sort: fix buffer under-read in", " src/sort.c, tests/local.mk, tests/sort/sort-field-limit.sh,", " Makefile.in.", " - CVE-2025-5278", "" ], "package": "coreutils", "version": "9.4-3ubuntu6.3", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 25 Aug 2026 11:09:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "cpio", "from_version": { "source_package_name": "cpio", "source_package_version": "2.15+dfsg-1ubuntu2", "version": "2.15+dfsg-1ubuntu2" }, "to_version": { "source_package_name": "cpio", "source_package_version": "2.15+dfsg-1ubuntu2.1", "version": "2.15+dfsg-1ubuntu2.1" }, "cves": [ { "cve": "CVE-2026-66485", "url": "https://ubuntu.com/security/CVE-2026-66485", "cve_description": "GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66484", "url": "https://ubuntu.com/security/CVE-2026-66484", "cve_description": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66486", "url": "https://ubuntu.com/security/CVE-2026-66486", "cve_description": "GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2019-14866", "url": "https://ubuntu.com/security/CVE-2019-14866", "cve_description": "In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.", "cve_priority": "medium", "cve_public_date": "2020-01-07 17:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-66485", "url": "https://ubuntu.com/security/CVE-2026-66485", "cve_description": "GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66484", "url": "https://ubuntu.com/security/CVE-2026-66484", "cve_description": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66486", "url": "https://ubuntu.com/security/CVE-2026-66486", "cve_description": "GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2019-14866", "url": "https://ubuntu.com/security/CVE-2019-14866", "cve_description": "In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.", "cve_priority": "medium", "cve_public_date": "2020-01-07 17:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unbounded stack allocation", " - debian/patches/CVE-2026-66485.patch: Minor fixes in src/makepath.c,", " src/userspec.c.", " - CVE-2026-66485", " * SECURITY UPDATE: Hard link to file outside intended directory", " - debian/patches/CVE-2026-66484.patch: The --no-absolute-filenames option", " affects hard link targets too. in src/tar.c.", " - CVE-2026-66484", " * SECURITY UPDATE: Unescaped output", " - debian/patches/CVE-2026-66486.patch: Quote file names in error messages", " and in listings. in src/copyin.c, src/copyout.c, src/copypass.c,", " src/main.c, tests/CVE-2019-14866.at, tests/testsuite.", " - CVE-2026-66486", "" ], "package": "cpio", "version": "2.15+dfsg-1ubuntu2.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Isabel Garcia Contreras ", "date": "Tue, 18 Aug 2026 14:18:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "diffutils", "from_version": { "source_package_name": "diffutils", "source_package_version": "1:3.10-1build1", "version": "1:3.10-1build1" }, "to_version": { "source_package_name": "diffutils", "source_package_version": "1:3.10-1ubuntu0.1", "version": "1:3.10-1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Integer Overflow", " - debian/patches/CVE-2026-53910-1.patch: diff3: check for integer overflows", " when reading line numbers from diff in NEWS, THANKS, src/diff3.c.", " - debian/patches/CVE-2026-53910-2.patch: diff3: prevent overflow in line", " offsets in src/diff3.c.", " - CVE-2026-53910", "" ], "package": "diffutils", "version": "1:3.10-1ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 26 Aug 2026 14:15:46 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "dirmngr", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "eject", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "fdisk", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gnupg", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gnupg-l10n", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gnupg-utils", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpg", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpg-agent", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpg-wks-client", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgconf", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgsm", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgv", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "keyboxd", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libattr1:riscv64", "from_version": { "source_package_name": "attr", "source_package_version": "1:2.5.2-1build1.1", "version": "1:2.5.2-1build1.1" }, "to_version": { "source_package_name": "attr", "source_package_version": "1:2.5.2-1ubuntu0.1", "version": "1:2.5.2-1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Symlink Traversal", " - d/p/CVE-2026-54371-01-add-visibility-attribute-header.patch: Add", " visibility attribute header in include/Makemodule.am, include/visibility-", " hidden.h.", " - d/p/CVE-2026-54371-02-add-xattrat-syscall-wrappers.patch: Add xattrat", " syscall wrappers in configure.ac, include/Makemodule.am,", " include/xattrat.h, libmisc/Makemodule.am, libmisc/xattrat.c.", " - d/p/CVE-2026-54371-03-add-xattrat-syscall-backwards-compatibility-", " code.patch: Add xattrat syscall backwards compatibility code in", " include/Makemodule.am, include/xattrat_compat.h, libmisc/Makemodule.am,", " libmisc/getxattrat_compat.c, libmisc/listxattrat_compat.c, libmisc/proc-", " self-fd.c, libmisc/proc-self-fd.h, libmisc/removexattrat_compat.c,", " libmisc/setxattrat_compat.c.", " - d/p/CVE-2026-54371-04-rename-walk_tree-to-old_walk_tree.patch: Rename", " walk_tree to old_walk_tree in include/Makemodule.am,", " include/old_walk_tree.h, libmisc/Makemodule.am, libmisc/old_walk_tree.c,", " tools/getfattr.c.", " - d/p/CVE-2026-54371-05-add-the-new-walk_tree-helper.patch: Add the new", " walk_tree helper in include/Makemodule.am, include/walk_tree.h,", " libmisc/Makemodule.am, libmisc/walk_tree.c.", " - debian/patches/CVE-2026-54371-06-harden-getfattr.patch: harden getfattr in", " man/man1/getfattr.1, tools/getfattr.c, test/root/getfattr.test.", " - d/p/CVE-2026-54371-07-setfattr-multiple-restore-accesses-freed-", " buffer.patch: setfattr: multiple --restore accesses freed buffer in", " tools/setfattr.c.", " - d/p/CVE-2026-54371-08-setfattr-do-not-ignore-no-dereference-after-", " restore.patch: setfattr: Do not ignore --no-dereference after --restore in", " tools/setfattr.c.", " - d/p/CVE-2026-54371-09-add-openat2-syscall-wrapper.patch: Add openat2", " syscall wrapper in configure.ac, include/Makemodule.am, include/openat2.h,", " libmisc/Makemodule.am, libmisc/openat2.c.", " - debian/patches/CVE-2026-54371-10-harden-setfattr-restore.patch: harden", " setfattr --restore in configure.ac, man/man1/setfattr.1,", " test/Makemodule.am, tools/setfattr.c, test/restore.test.", " - CVE-2026-54371", "" ], "package": "attr", "version": "1:2.5.2-1ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Sun, 23 Aug 2026 21:39:46 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblkid1:riscv64", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbz2-1.0:riscv64", "from_version": { "source_package_name": "bzip2", "source_package_version": "1.0.8-5.1build0.1", "version": "1.0.8-5.1build0.1" }, "to_version": { "source_package_name": "bzip2", "source_package_version": "1.0.8-5.1ubuntu0.1", "version": "1.0.8-5.1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-42250", "url": "https://ubuntu.com/security/CVE-2026-42250", "cve_description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "cve_priority": "low", "cve_public_date": "2026-05-28 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42250", "url": "https://ubuntu.com/security/CVE-2026-42250", "cve_description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "cve_priority": "low", "cve_public_date": "2026-05-28 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: out-of-bounds write", " - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not", " process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.", " - CVE-2026-42250", "" ], "package": "bzip2", "version": "1.0.8-5.1ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shishir Subedi ", "date": "Thu, 27 Aug 2026 09:50:50 +0545" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.8", "version": "2.39-0ubuntu8.8" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.9", "version": "2.39-0ubuntu8.9" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.39-0ubuntu8.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:15:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-dev-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.8", "version": "2.39-0ubuntu8.8" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.9", "version": "2.39-0ubuntu8.9" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.39-0ubuntu8.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:15:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-devtools", "from_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.8", "version": "2.39-0ubuntu8.8" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.9", "version": "2.39-0ubuntu8.9" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.39-0ubuntu8.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:15:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6:riscv64", "from_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.8", "version": "2.39-0ubuntu8.8" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.9", "version": "2.39-0ubuntu8.9" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.39-0ubuntu8.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:15:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6-dev:riscv64", "from_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.8", "version": "2.39-0ubuntu8.8" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.9", "version": "2.39-0ubuntu8.9" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.39-0ubuntu8.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:15:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libevent-core-2.1-7t64:riscv64", "from_version": { "source_package_name": "libevent", "source_package_version": "2.1.12-stable-9ubuntu2", "version": "2.1.12-stable-9ubuntu2" }, "to_version": { "source_package_name": "libevent", "source_package_version": "2.1.12-stable-9ubuntu2.1", "version": "2.1.12-stable-9ubuntu2.1" }, "cves": [ { "cve": "CVE-2026-63381", "url": "https://ubuntu.com/security/CVE-2026-63381", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63382", "url": "https://ubuntu.com/security/CVE-2026-63382", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63383", "url": "https://ubuntu.com/security/CVE-2026-63383", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63384", "url": "https://ubuntu.com/security/CVE-2026-63384", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63385", "url": "https://ubuntu.com/security/CVE-2026-63385", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-63381", "url": "https://ubuntu.com/security/CVE-2026-63381", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63382", "url": "https://ubuntu.com/security/CVE-2026-63382", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63383", "url": "https://ubuntu.com/security/CVE-2026-63383", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63384", "url": "https://ubuntu.com/security/CVE-2026-63384", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63385", "url": "https://ubuntu.com/security/CVE-2026-63385", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: dangling pointer in buffer reference handling", " - debian/patches/CVE-2026-63381.patch: reset empty output buffer", " pointers and add regression coverage in buffer.c and", " test/regress_buffer.c.", " - CVE-2026-63381", " * SECURITY UPDATE: HTTP request smuggling in request body framing", " - debian/patches/CVE-2026-63382_1.patch: require strict CRLF chunk", " delimiters in http.c.", " - debian/patches/CVE-2026-63382_2.patch: validate transfer encodings", " and add tests in http-internal.h, http.c, and test/regress_http.c.", " - CVE-2026-63382", " * SECURITY UPDATE: out-of-bounds read during RPC tag decoding", " - debian/patches/CVE-2026-63383.patch: bound tag decoding to contiguous", " buffer data in event_tagging.c.", " - CVE-2026-63383", " * SECURITY UPDATE: integer overflow during RPC payload length decoding", " - debian/patches/CVE-2026-63384.patch: reject oversized RPC payload", " lengths in event_tagging.c and document the limit in", " include/event2/tag.h.", " - CVE-2026-63384", " * SECURITY UPDATE: HTTP header injection during folded header handling", " - debian/patches/CVE-2026-63385.patch: reject CR and LF in HTTP header", " values and update tests in http.c and test/regress_http.c.", " - CVE-2026-63385", "" ], "package": "libevent", "version": "2.1.12-stable-9ubuntu2.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Fri, 28 Aug 2026 16:44:18 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfdisk1:riscv64", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgcrypt20:riscv64", "from_version": { "source_package_name": "libgcrypt20", "source_package_version": "1.10.3-2ubuntu0.1", "version": "1.10.3-2ubuntu0.1" }, "to_version": { "source_package_name": "libgcrypt20", "source_package_version": "1.10.3-2ubuntu0.2", "version": "1.10.3-2ubuntu0.2" }, "cves": [ { "cve": "CVE-2024-2236", "url": "https://ubuntu.com/security/CVE-2024-2236", "cve_description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "cve_priority": "low", "cve_public_date": "2024-03-06 22:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2024-2236", "url": "https://ubuntu.com/security/CVE-2024-2236", "cve_description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "cve_priority": "low", "cve_public_date": "2024-03-06 22:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: timing-based side-channel flaw in RSA implementation", " - debian/patches/CVE-2024-2236-1.patch: rsa: Do not accept invalid PKCS#1.5", " padding when deciphering in cipher/rsa-common.c, src/const-time.h.", " - debian/patches/CVE-2024-2236-2.patch: rsa: Constant time blinding removal", " in cipher/rsa.c, configure.ac, mpi/Makefile.am, mpi/mpi-internal.h,", " mpi/mpi-mul-cs.c, mpi/mpi-mul.c, src/gcrypt-int.h.", " - debian/patches/CVE-2024-2236-3.patch: Constant time conversion of the", " message to the SEXP in cipher/rsa.c, src/const-time.c, src/const-time.h,", " src/sexp.c.", " - debian/patches/CVE-2024-2236-4.patch: rsa: Implement constant-time", " conversion of MPI to string in cipher/rsa-common.c.", " - debian/patches/CVE-2024-2236-5.patch: cipher: Use the constant time", " conversion also for OAEP in cipher/rsa-common.c, cipher/rsa.c.", " - debian/patches/CVE-2024-2236-6.patch: Implement implicit rejection for", " PKCS#1.5 decipher in cipher/pubkey-internal.h, cipher/pubkey-util.c,", " cipher/rsa-common.c, cipher/rsa.c, src/cipher.h, src/const-time.c,", " src/const-time.h, tests/pkcs1v2-v15c.h, tests/pkcs1v2.c.", " - debian/rules: build with --enable-marvin-workaround.", " - Thanks for Red Hat for the patches!", " - CVE-2024-2236", "" ], "package": "libgcrypt20", "version": "1.10.3-2ubuntu0.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 24 Aug 2026 14:06:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libheif-plugin-aomdec:riscv64", "from_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.7", "version": "1.17.6-1ubuntu4.7" }, "to_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.8", "version": "1.17.6-1ubuntu4.8" }, "cves": [ { "cve": "CVE-2026-62291", "url": "https://ubuntu.com/security/CVE-2026-62291", "cve_description": "libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.", "cve_priority": "medium", "cve_public_date": "2026-08-18 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-62291", "url": "https://ubuntu.com/security/CVE-2026-62291", "cve_description": "libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.", "cve_priority": "medium", "cve_public_date": "2026-08-18 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Heap out-of-bounds write in uncompressed encoder.", " - debian/patches/CVE-2026-62291.patch: Validate component plane sizes", " against primary image dimensions and propagate encode errors in", " libheif/uncompressed_image.cc, libheif/uncompressed_image.h,", " libheif/context.cc.", " - CVE-2026-62291", "" ], "package": "libheif", "version": "1.17.6-1ubuntu4.8", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 25 Aug 2026 12:17:59 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libheif-plugin-aomenc:riscv64", "from_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.7", "version": "1.17.6-1ubuntu4.7" }, "to_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.8", "version": "1.17.6-1ubuntu4.8" }, "cves": [ { "cve": "CVE-2026-62291", "url": "https://ubuntu.com/security/CVE-2026-62291", "cve_description": "libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.", "cve_priority": "medium", "cve_public_date": "2026-08-18 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-62291", "url": "https://ubuntu.com/security/CVE-2026-62291", "cve_description": "libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.", "cve_priority": "medium", "cve_public_date": "2026-08-18 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Heap out-of-bounds write in uncompressed encoder.", " - debian/patches/CVE-2026-62291.patch: Validate component plane sizes", " against primary image dimensions and propagate encode errors in", " libheif/uncompressed_image.cc, libheif/uncompressed_image.h,", " libheif/context.cc.", " - CVE-2026-62291", "" ], "package": "libheif", "version": "1.17.6-1ubuntu4.8", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 25 Aug 2026 12:17:59 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libheif1:riscv64", "from_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.7", "version": "1.17.6-1ubuntu4.7" }, "to_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.8", "version": "1.17.6-1ubuntu4.8" }, "cves": [ { "cve": "CVE-2026-62291", "url": "https://ubuntu.com/security/CVE-2026-62291", "cve_description": "libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.", "cve_priority": "medium", "cve_public_date": "2026-08-18 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-62291", "url": "https://ubuntu.com/security/CVE-2026-62291", "cve_description": "libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.", "cve_priority": "medium", "cve_public_date": "2026-08-18 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Heap out-of-bounds write in uncompressed encoder.", " - debian/patches/CVE-2026-62291.patch: Validate component plane sizes", " against primary image dimensions and propagate encode errors in", " libheif/uncompressed_image.cc, libheif/uncompressed_image.h,", " libheif/context.cc.", " - CVE-2026-62291", "" ], "package": "libheif", "version": "1.17.6-1ubuntu4.8", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 25 Aug 2026 12:17:59 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libmount1:riscv64", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libncurses6:riscv64", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libncursesw6:riscv64", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libp11-kit0:riscv64", "from_version": { "source_package_name": "p11-kit", "source_package_version": "0.25.3-4ubuntu2.1", "version": "0.25.3-4ubuntu2.1" }, "to_version": { "source_package_name": "p11-kit", "source_package_version": "0.25.3-4ubuntu2.2", "version": "0.25.3-4ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-18938", "url": "https://ubuntu.com/security/CVE-2026-18938", "cve_description": "A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.", "cve_priority": "medium", "cve_public_date": "2026-08-07 09:16:00 UTC" }, { "cve": "CVE-2026-13757", "url": "https://ubuntu.com/security/CVE-2026-13757", "cve_description": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.", "cve_priority": "medium", "cve_public_date": "2026-06-29 19:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-18938", "url": "https://ubuntu.com/security/CVE-2026-18938", "cve_description": "A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.", "cve_priority": "medium", "cve_public_date": "2026-08-07 09:16:00 UTC" }, { "cve": "CVE-2026-13757", "url": "https://ubuntu.com/security/CVE-2026-13757", "cve_description": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.", "cve_priority": "medium", "cve_public_date": "2026-06-29 19:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: integer overflow in nested attribute decoding", " - debian/patches/CVE-2026-18938.patch: guard against overflow when", " decoding nested attributes (32-bit only, heap OOB write, DoS).", " - CVE-2026-18938", " * SECURITY UPDATE: unbounded recursion in RPC attribute parsing", " - debian/patches/CVE-2026-13757.patch: add recursion depth limit into", " RPC attribute parsing (stack exhaustion, DoS).", " - CVE-2026-13757", "" ], "package": "p11-kit", "version": "0.25.3-4ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Mon, 24 Aug 2026 13:57:12 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules:riscv64", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules-bin", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-runtime", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam0g:riscv64", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libperl5.38t64:riscv64", "from_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.3", "version": "5.38.2-3.2ubuntu0.3" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.4", "version": "5.38.2-3.2ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", " [ LeoSilva ]", " * SECURITY UPDATE: uncaught exception in IO::Uncompress::Unzip DOS date", " parsing", " - debian/patches/CVE-2025-15649.patch: wrap _dosToUnixTime() in eval", " and return zero for empty/out-of-range date fields in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2025-15649", " [ LeoSilva ]", " * SECURITY UPDATE: CPU exhaustion in IO::Uncompress::Unzip fastForward", " - debian/patches/CVE-2026-48959.patch: fix per-byte read loop caused", " by comparing length $offset instead of $offset in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2026-48959", " [ LeoSilva ]", " * SECURITY UPDATE: arbitrary code execution in File::GlobMapper", " - debian/patches/CVE-2026-48962.patch: remove use of eval STRING in", " _parseOutputGlob/_getFiles, replacing with safe delimiter-based", " substitution in cpan/IO-Compress/lib/File/GlobMapper.pm", " - CVE-2026-48962", " [ LeoSilva ]", " * SECURITY UPDATE: credential header leakage on cross-origin redirects", " in HTTP::Tiny", " - debian/patches/CVE-2026-7017.patch: strip Authorization, Cookie and", " Proxy-Authorization headers on cross-origin redirects, refuse", " https-to-http downgrade by default in", " cpan/HTTP-Tiny/lib/HTTP/Tiny.pm", " - CVE-2026-7017", " [ LeoSilva ]", " * SECURITY UPDATE: memory exhaustion in Archive::Tar entry size handling", " - debian/patches/CVE-2026-9538.patch: add $MAX_FILE_SIZE cap to", " refuse oversized entry declarations before allocation in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-9538", "" ], "package": "perl", "version": "5.38.2-3.2ubuntu0.4", "urgency": "high", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 18 Aug 2026 17:25:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.12-minimal:riscv64", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.17", "version": "3.12.3-1ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.17", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:26 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.12-stdlib:riscv64", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.17", "version": "3.12.3-1ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.17", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:26 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.12t64:riscv64", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.17", "version": "3.12.3-1ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.17", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:26 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsmartcols1:riscv64", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssh-4:riscv64", "from_version": { "source_package_name": "libssh", "source_package_version": "0.10.6-2ubuntu0.4", "version": "0.10.6-2ubuntu0.4" }, "to_version": { "source_package_name": "libssh", "source_package_version": "0.10.6-2ubuntu0.5", "version": "0.10.6-2ubuntu0.5" }, "cves": [ { "cve": "CVE-2026-59843", "url": "https://ubuntu.com/security/CVE-2026-59843", "cve_description": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59845", "url": "https://ubuntu.com/security/CVE-2026-59845", "cve_description": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59846", "url": "https://ubuntu.com/security/CVE-2026-59846", "cve_description": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.", "cve_priority": "medium", "cve_public_date": "2026-07-21 13:17:00 UTC" }, { "cve": "CVE-2026-59847", "url": "https://ubuntu.com/security/CVE-2026-59847", "cve_description": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59848", "url": "https://ubuntu.com/security/CVE-2026-59848", "cve_description": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59850", "url": "https://ubuntu.com/security/CVE-2026-59850", "cve_description": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59843", "url": "https://ubuntu.com/security/CVE-2026-59843", "cve_description": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59845", "url": "https://ubuntu.com/security/CVE-2026-59845", "cve_description": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59846", "url": "https://ubuntu.com/security/CVE-2026-59846", "cve_description": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.", "cve_priority": "medium", "cve_public_date": "2026-07-21 13:17:00 UTC" }, { "cve": "CVE-2026-59847", "url": "https://ubuntu.com/security/CVE-2026-59847", "cve_description": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59848", "url": "https://ubuntu.com/security/CVE-2026-59848", "cve_description": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59850", "url": "https://ubuntu.com/security/CVE-2026-59850", "cve_description": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Denial of service via zero advertised channel packet size", " - debian/patches/CVE-2026-59843-1.patch: channels: Fail when receiving max", " packet size 0 in src/channels.c, src/messages.c.", " - debian/patches/CVE-2026-59843-2.patch: tests: Verify zero max packet size", " in channel open is rejected in tests/unittests/torture_channel.c.", " - CVE-2026-59843", " * SECURITY UPDATE: Denial of service via unchecked ProxyCommand fork() failure", " - debian/patches/CVE-2026-59845.patch: socket: Properly check fork() return", " code in src/socket.c.", " - CVE-2026-59845", " * SECURITY UPDATE: Information disclosure via ProxyCommand %r username", " expansion", " - debian/patches/CVE-2026-59846-pre1.patch: misc: Add function to check", " username syntax in include/libssh/misc.h, src/misc.c,", " tests/unittests/torture_misc.c.", " - debian/patches/CVE-2026-59846.patch: Block shell metacharacters from", " usernames in include/libssh/priv.h, src/misc.c.", " - CVE-2026-59846", " * SECURITY UPDATE: Integrity downgrade via OpenSSL AES-GCM tag verification", " - debian/patches/CVE-2026-59847-1.patch: libcrypto: Fix tag verification of", " AES-GCM ciphers in src/libcrypto.c.", " - debian/patches/CVE-2026-59847-2.patch: libcrypto: Fix symmetric issue", " during encryption in src/libcrypto.c.", " - CVE-2026-59847", " * SECURITY UPDATE: Denial of service via SFTP responses with unknown request", " IDs", " - debian/patches/CVE-2026-59848-1.patch: sftp: handle responses with unknown", " request IDs in include/libssh/sftp.h, src/sftp.c,", " tests/client/torture_sftp_request_id.c, tests/client/CMakeLists.txt.", " - debian/patches/CVE-2026-59848-2.patch: sftp: Initialize sftp_request_queue", " ptr in sftp_free in src/sftp.c.", " - CVE-2026-59848", " * SECURITY UPDATE: Use-after-free via data callbacks on closed channels", " - debian/patches/CVE-2026-59850.patch: channels: Avoid processing DATA", " packets on closed channels in src/channels.c.", " - CVE-2026-59850", "" ], "package": "libssh", "version": "0.10.6-2ubuntu0.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 24 Aug 2026 10:59:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libtinfo6:riscv64", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libudisks2-0:riscv64", "from_version": { "source_package_name": "udisks2", "source_package_version": "2.10.1-6ubuntu1.3", "version": "2.10.1-6ubuntu1.3" }, "to_version": { "source_package_name": "udisks2", "source_package_version": "2.10.1-6ubuntu1.5", "version": "2.10.1-6ubuntu1.5" }, "cves": [ { "cve": "CVE-2026-7867", "url": "https://ubuntu.com/security/CVE-2026-7867", "cve_description": "A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.", "cve_priority": "medium", "cve_public_date": "2026-08-06 22:18:00 UTC" } ], "launchpad_bugs_fixed": [ 2156438 ], "changes": [ { "cves": [ { "cve": "CVE-2026-7867", "url": "https://ubuntu.com/security/CVE-2026-7867", "cve_description": "A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.", "cve_priority": "medium", "cve_public_date": "2026-08-06 22:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Privilege escalation via mount point injection", " - debian/patches/CVE-2026-7867-1.patch: udiskslinuxfilesystem: Separate real", " caller identity from as-user target in src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-2.patch: udiskslinuxfilesystem: Rework fstab", " mount authorization for as-user in data/org.freedesktop.UDisks2.xml,", " src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-3.patch: udiskslinuxfilesystem: Log real", " caller uid for as-user mounts in src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-4.patch: udisksdaemonutil: Pass as-user", " target to polkit details in src/udisksdaemonutil.c.", " - debian/patches/CVE-2026-7867-5.patch: tests: Add security tests for as-", " user mount authorization in src/tests/dbus-tests/test_80_filesystem.py.", " - CVE-2026-7867", "" ], "package": "udisks2", "version": "2.10.1-6ubuntu1.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 17 Aug 2026 10:49:58 -0400" }, { "cves": [], "log": [ "", " * d/t/upstream-system: install linux-modules-extra as this package provides", " the scsi_debug kernel module needed for the udisks2 tests.", " (LP: #2156438)", "" ], "package": "udisks2", "version": "2.10.1-6ubuntu1.4", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2156438 ], "author": "Hector Cao ", "date": "Wed, 01 Jul 2026 08:33:59 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libuuid1:riscv64", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-generic", "from_version": { "source_package_name": "linux-meta-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": "7.0.0-28.28.1~24.04.3" }, "to_version": { "source_package_name": "linux-meta-riscv-7.0", "source_package_version": "7.0.0-31.31.1~24.04.1+1", "version": "7.0.0-31.31.1~24.04.1+1" }, "cves": [], "launchpad_bugs_fixed": [ 1975592, 1786013 ], "changes": [ { "cves": [], "log": [ "", "", " * Enable Nezha board (LP: #1975592)", " - [Packaging] Add allwinner transitionals", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1+1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1975592 ], "author": "Sarah Emery ", "date": "Wed, 26 Aug 2026 13:12:13 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31.1~24.04.1", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Mon, 24 Aug 2026 10:39:35 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-30.30.1~24.04.1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-30.30.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Fri, 21 Aug 2026 15:20:27 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-virtual", "from_version": { "source_package_name": "linux-meta-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": "7.0.0-28.28.1~24.04.3" }, "to_version": { "source_package_name": "linux-meta-riscv-7.0", "source_package_version": "7.0.0-31.31.1~24.04.1+1", "version": "7.0.0-31.31.1~24.04.1+1" }, "cves": [], "launchpad_bugs_fixed": [ 1975592, 1786013 ], "changes": [ { "cves": [], "log": [ "", "", " * Enable Nezha board (LP: #1975592)", " - [Packaging] Add allwinner transitionals", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1+1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1975592 ], "author": "Sarah Emery ", "date": "Wed, 26 Aug 2026 13:12:13 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31.1~24.04.1", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Mon, 24 Aug 2026 10:39:35 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-30.30.1~24.04.1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-30.30.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Fri, 21 Aug 2026 15:20:27 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": "7.0.0-28.28.1~24.04.3" }, "to_version": { "source_package_name": "linux-meta-riscv-7.0", "source_package_version": "7.0.0-31.31.1~24.04.1+1", "version": "7.0.0-31.31.1~24.04.1+1" }, "cves": [], "launchpad_bugs_fixed": [ 1975592, 1786013 ], "changes": [ { "cves": [], "log": [ "", "", " * Enable Nezha board (LP: #1975592)", " - [Packaging] Add allwinner transitionals", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1+1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1975592 ], "author": "Sarah Emery ", "date": "Wed, 26 Aug 2026 13:12:13 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31.1~24.04.1", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Mon, 24 Aug 2026 10:39:35 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-30.30.1~24.04.1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-30.30.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Fri, 21 Aug 2026 15:20:27 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-libc-dev:riscv64", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-139.139", "version": "6.8.0-139.139" }, "cves": [ { "cve": "CVE-2025-71289", "url": "https://ubuntu.com/security/CVE-2025-71289", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.", "cve_priority": "medium", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-46315", "url": "https://ubuntu.com/security/CVE-2026-46315", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it does not initialize info itself. If the wait operation completes without reporting a child event, the common wait code can return without writing wo_info. In that case io_waitid_finish() still copies iw->info to userspace, exposing stale bytes from the reused io_kiocb command storage. Clear the result storage during prep so the io_uring path matches the regular waitid syscall, which uses a zero-initialized struct waitid_info.", "cve_priority": "medium", "cve_public_date": "2026-06-09 09:16:00 UTC" }, { "cve": "CVE-2026-31486", "url": "https://ubuntu.com/security/CVE-2026-31486", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h.", "cve_priority": "medium", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-23469", "url": "https://ubuntu.com/security/CVE-2026-23469", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU core and doesn't wait for it to finish. Depending on timing, the IRQ handler could be running while the GPU is suspended, leading to kernel crashes when trying to access GPU registers. See example signature below. In a power off sequence initiated by the runtime PM suspend callback, wait for any IRQ handlers in progress on other CPU cores to finish, by calling synchronize_irq(). At the same time, remove the runtime PM resume/put calls in the threaded IRQ handler. On top of not being the right approach to begin with, and being at the wrong place as they should have wrapped all GPU register accesses, the driver would hit a deadlock between synchronize_irq() being called from a runtime PM suspend callback, holding the device power lock, and the resume callback requiring the same. Example crash signature on a TI AM68 SK platform: [ 337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError [ 337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241246] Tainted: [M]=MACHINE_CHECK [ 337.241249] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 337.241256] pc : pvr_riscv_irq_pending+0xc/0x24 [ 337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310 [ 337.241282] sp : ffff800085b0bd30 [ 337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10 [ 337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000 [ 337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30 [ 337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001 [ 337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40 [ 337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a [ 337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00 [ 337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003 [ 337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000 [ 337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000 [ 337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt [ 337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241342] Tainted: [M]=MACHINE_CHECK [ 337.241343] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241345] Call trace: [ 337.241348] show_stack+0x18/0x24 (C) [ 337.241357] dump_stack_lvl+0x60/0x80 [ 337.241364] dump_stack+0x18/0x24 [ 337.241368] vpanic+0x124/0x2ec [ 337.241373] abort+0x0/0x4 [ 337.241377] add_taint+0x0/0xbc [ 337.241384] arm64_serror_panic+0x70/0x80 [ 337.241389] do_serror+0x3c/0x74 [ 337.241392] el1h_64_error_handler+0x30/0x48 [ 337.241400] el1h_64_error+0x6c/0x70 [ 337.241404] pvr_riscv_irq_pending+0xc/0x24 (P) [ 337.241410] irq_thread_fn+0x2c/0xb0 [ 337.241416] irq_thread+0x170/0x334 [ 337.241421] kthread+0x12c/0x210 [ 337.241428] ret_from_fork+0x10/0x20 [ 337.241434] SMP: stopping secondary CPUs [ 337.241451] Kernel Offset: disabled [ 337.241453] CPU features: 0x040000,02002800,20002001,0400421b [ 337.241456] Memory Limit: none [ 337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---", "cve_priority": "medium", "cve_public_date": "2026-04-03 16:16:00 UTC" }, { "cve": "CVE-2026-31560", "url": "https://ubuntu.com/security/CVE-2026-31560", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: spi: spi-dw-dma: fix print error log when wait finish transaction If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*).", "cve_priority": "medium", "cve_public_date": "2026-04-24 15:16:00 UTC" }, { "cve": "CVE-2026-31420", "url": "https://ubuntu.com/security/CVE-2026-31420", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.", "cve_priority": "medium", "cve_public_date": "2026-04-13 14:16:00 UTC" }, { "cve": "CVE-2026-46275", "url": "https://ubuntu.com/security/CVE-2026-46275", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.", "cve_priority": "high", "cve_public_date": "2026-06-08 16:16:00 UTC" }, { "cve": "CVE-2026-46170", "url": "https://ubuntu.com/security/CVE-2026-46170", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on \"itself\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-46158", "url": "https://ubuntu.com/security/CVE-2026-46158", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as \"unlikely\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46242", "url": "https://ubuntu.com/security/CVE-2026-46242", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.", "cve_priority": "high", "cve_public_date": "2026-05-30 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52931", "url": "https://ubuntu.com/security/CVE-2026-52931", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-52914", "url": "https://ubuntu.com/security/CVE-2026-52914", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-46325", "url": "https://ubuntu.com/security/CVE-2026-46325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/", "cve_priority": "low", "cve_public_date": "2026-06-09 14:16:00 UTC" }, { "cve": "CVE-2026-43465", "url": "https://ubuntu.com/security/CVE-2026-43465", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb: - The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0. - The test sends one packet with no payload. - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above. - The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain more data, the program drops the tail fragment since it no longer contains any payload (pp_ref_count=63). - mlx5 device skips counting this fragment. Internal frag counter remains 0. - mlx5 releases all 64 fragments of the page but page pp_ref_count is 63 => negative reference counting error. Resulting splat during the test: WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] Modules linked in: [...] CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] [...] Call Trace: mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] mlx5e_close_rq+0x78/0xa0 [mlx5_core] mlx5e_close_queues+0x46/0x2a0 [mlx5_core] mlx5e_close_channel+0x24/0x90 [mlx5_core] mlx5e_close_channels+0x5d/0xf0 [mlx5_core] mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] mlx5e_change_mtu+0x11d/0x490 [mlx5_core] mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] netif_set_mtu_ext+0xfc/0x240 do_setlink.isra.0+0x226/0x1100 rtnl_newlink+0x7a9/0xba0 rtnetlink_rcv_msg+0x220/0x3c0 netlink_rcv_skb+0x4b/0xf0 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x240 ___sys_sendmsg+0x7c/0xb0 [...] __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xc70 The problem applies for XDP_PASS as well which is handled in a different code path in the driver. This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag. As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags.", "cve_priority": "low", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43197", "url": "https://ubuntu.com/security/CVE-2026-43197", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)", "cve_priority": "negligible", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43083", "url": "https://ubuntu.com/security/CVE-2026-43083", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.", "cve_priority": "high", "cve_public_date": "2026-05-06 10:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162466, 1786013, 2072994, 2159608, 2160302, 2158920, 2139686, 2158462, 2155609, 2142613, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250 ], "changes": [ { "cves": [ { "cve": "CVE-2025-71289", "url": "https://ubuntu.com/security/CVE-2025-71289", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.", "cve_priority": "medium", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-46315", "url": "https://ubuntu.com/security/CVE-2026-46315", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it does not initialize info itself. If the wait operation completes without reporting a child event, the common wait code can return without writing wo_info. In that case io_waitid_finish() still copies iw->info to userspace, exposing stale bytes from the reused io_kiocb command storage. Clear the result storage during prep so the io_uring path matches the regular waitid syscall, which uses a zero-initialized struct waitid_info.", "cve_priority": "medium", "cve_public_date": "2026-06-09 09:16:00 UTC" }, { "cve": "CVE-2026-31486", "url": "https://ubuntu.com/security/CVE-2026-31486", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h.", "cve_priority": "medium", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-23469", "url": "https://ubuntu.com/security/CVE-2026-23469", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU core and doesn't wait for it to finish. Depending on timing, the IRQ handler could be running while the GPU is suspended, leading to kernel crashes when trying to access GPU registers. See example signature below. In a power off sequence initiated by the runtime PM suspend callback, wait for any IRQ handlers in progress on other CPU cores to finish, by calling synchronize_irq(). At the same time, remove the runtime PM resume/put calls in the threaded IRQ handler. On top of not being the right approach to begin with, and being at the wrong place as they should have wrapped all GPU register accesses, the driver would hit a deadlock between synchronize_irq() being called from a runtime PM suspend callback, holding the device power lock, and the resume callback requiring the same. Example crash signature on a TI AM68 SK platform: [ 337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError [ 337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241246] Tainted: [M]=MACHINE_CHECK [ 337.241249] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 337.241256] pc : pvr_riscv_irq_pending+0xc/0x24 [ 337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310 [ 337.241282] sp : ffff800085b0bd30 [ 337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10 [ 337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000 [ 337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30 [ 337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001 [ 337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40 [ 337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a [ 337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00 [ 337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003 [ 337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000 [ 337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000 [ 337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt [ 337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241342] Tainted: [M]=MACHINE_CHECK [ 337.241343] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241345] Call trace: [ 337.241348] show_stack+0x18/0x24 (C) [ 337.241357] dump_stack_lvl+0x60/0x80 [ 337.241364] dump_stack+0x18/0x24 [ 337.241368] vpanic+0x124/0x2ec [ 337.241373] abort+0x0/0x4 [ 337.241377] add_taint+0x0/0xbc [ 337.241384] arm64_serror_panic+0x70/0x80 [ 337.241389] do_serror+0x3c/0x74 [ 337.241392] el1h_64_error_handler+0x30/0x48 [ 337.241400] el1h_64_error+0x6c/0x70 [ 337.241404] pvr_riscv_irq_pending+0xc/0x24 (P) [ 337.241410] irq_thread_fn+0x2c/0xb0 [ 337.241416] irq_thread+0x170/0x334 [ 337.241421] kthread+0x12c/0x210 [ 337.241428] ret_from_fork+0x10/0x20 [ 337.241434] SMP: stopping secondary CPUs [ 337.241451] Kernel Offset: disabled [ 337.241453] CPU features: 0x040000,02002800,20002001,0400421b [ 337.241456] Memory Limit: none [ 337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---", "cve_priority": "medium", "cve_public_date": "2026-04-03 16:16:00 UTC" }, { "cve": "CVE-2026-31560", "url": "https://ubuntu.com/security/CVE-2026-31560", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: spi: spi-dw-dma: fix print error log when wait finish transaction If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*).", "cve_priority": "medium", "cve_public_date": "2026-04-24 15:16:00 UTC" }, { "cve": "CVE-2026-31420", "url": "https://ubuntu.com/security/CVE-2026-31420", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.", "cve_priority": "medium", "cve_public_date": "2026-04-13 14:16:00 UTC" }, { "cve": "CVE-2026-46275", "url": "https://ubuntu.com/security/CVE-2026-46275", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.", "cve_priority": "high", "cve_public_date": "2026-06-08 16:16:00 UTC" }, { "cve": "CVE-2026-46170", "url": "https://ubuntu.com/security/CVE-2026-46170", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on \"itself\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-46158", "url": "https://ubuntu.com/security/CVE-2026-46158", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as \"unlikely\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46242", "url": "https://ubuntu.com/security/CVE-2026-46242", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.", "cve_priority": "high", "cve_public_date": "2026-05-30 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52931", "url": "https://ubuntu.com/security/CVE-2026-52931", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-52914", "url": "https://ubuntu.com/security/CVE-2026-52914", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-46325", "url": "https://ubuntu.com/security/CVE-2026-46325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/", "cve_priority": "low", "cve_public_date": "2026-06-09 14:16:00 UTC" }, { "cve": "CVE-2026-43465", "url": "https://ubuntu.com/security/CVE-2026-43465", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb: - The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0. - The test sends one packet with no payload. - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above. - The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain more data, the program drops the tail fragment since it no longer contains any payload (pp_ref_count=63). - mlx5 device skips counting this fragment. Internal frag counter remains 0. - mlx5 releases all 64 fragments of the page but page pp_ref_count is 63 => negative reference counting error. Resulting splat during the test: WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] Modules linked in: [...] CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] [...] Call Trace: mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] mlx5e_close_rq+0x78/0xa0 [mlx5_core] mlx5e_close_queues+0x46/0x2a0 [mlx5_core] mlx5e_close_channel+0x24/0x90 [mlx5_core] mlx5e_close_channels+0x5d/0xf0 [mlx5_core] mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] mlx5e_change_mtu+0x11d/0x490 [mlx5_core] mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] netif_set_mtu_ext+0xfc/0x240 do_setlink.isra.0+0x226/0x1100 rtnl_newlink+0x7a9/0xba0 rtnetlink_rcv_msg+0x220/0x3c0 netlink_rcv_skb+0x4b/0xf0 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x240 ___sys_sendmsg+0x7c/0xb0 [...] __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xc70 The problem applies for XDP_PASS as well which is handled in a different code path in the driver. This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag. As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags.", "cve_priority": "low", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43197", "url": "https://ubuntu.com/security/CVE-2026-43197", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)", "cve_priority": "negligible", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43083", "url": "https://ubuntu.com/security/CVE-2026-43083", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.", "cve_priority": "high", "cve_public_date": "2026-05-06 10:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-139.139 -proposed tracker (LP: #2162466)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " - [Packaging] debian.master/dkms-versions -- update from kernel-versions", " (main/2026.08.03)", "", " * kselftests_net.net:test_bpf.sh fails on ppc64el (LP: #2072994)", " - powerpc64/bpf: jit support for 32bit offset jmp instruction", " - powerpc64/bpf: jit support for unconditional byte swap", " - powerpc64/bpf: jit support for sign extended load", " - powerpc64/bpf: jit support for sign extended mov", " - powerpc64/bpf: jit support for signed division and modulo", "", " * noble/linux-raspi FTBFS: bcmasp phylib managed-EEE backport missing", " prerequisites (LP: #2159608)", " - SAUCE: Revert \"net: bcm: asp2: convert to phylib managed EEE\"", " - SAUCE: Revert \"net: bcm: asp2: remove tx_lpi_enabled\"", " - SAUCE: Revert \"net: bcm: asp2: fix LPI timer handling\"", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * noble-stable-2026-06-16 dropped a bracket causing FTBFS (LP: #2158920)", " - SAUCE: drm/v3d: Fix bracket drop FTBFS for non-generic kernels", "", " * ubuntu_bpf failed to build on Noble ( error: ‘XDP_UMEM_TX_METADATA_LEN’", " undeclared ) (LP: #2139686)", " - selftests/bpf: Add XDP_UMEM_TX_METADATA_LEN to XSK TX metadata test", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * net/tls: Three upstream fixes without CVE missing from Ubuntu", " 6.8.0-124-generic (LP: #2155609)", " - net: tls: fix silent data drop under pipe back-pressure", "", " * net:fcnal-test.sh fails because it can't find wait_local_port_listen on", " noble (LP: #2142613)", " - selftests: net: move wait_local_port_listen to lib.sh", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250)", " - mptcp: sync the msk->sndbuf at accept() time", " - mptcp: pm: ADD_ADDR rtx: allow ID 0", " - s390/debug: Reject zero-length input before trimming a newline", " - Revert \"x86/vdso: Fix output operand size of RDPID\"", " - Revert \"s390/cio: Update purge function to unregister the unused", " subchannels\"", " - sysfs: don't remove existing directory on update failure", " - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()", " - smb: client: protect tc_count increment in", " smb2_find_smb_sess_tcon_unlocked()", " - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close", " - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX", " - ALSA: ua101: Reject too-short USB descriptors", " - ALSA: pcm: Don't setup bogus iov_iter for silencing", " - ALSA: asihpi: Fix potential OOB array access at reading cache", " - efi: Allocate runtime workqueue before ACPI init", " - drivers/base/memory: fix memory block reference leak in poison", " accounting", " - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()", " - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()", " - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START", " - Bluetooth: bnep: Fix UAF read of dev->name", " - Bluetooth: MGMT: validate Add Extended Advertising Data length", " - Bluetooth: serialize accept_q access", " - phonet/pep: disable BH around forwarded sk_receive_skb()", " - net: bcmgenet: keep RBUF EEE/PM disabled", " - net: ifb: report ethtool stats over num_tx_queues", " - netfilter: ip6t_hbh: reject oversized option lists", " - netfilter: nf_queue: hold bridge skb->dev while queued", " - netfilter: ipset: stop hash:* range iteration at end", " - qed: fix double free in qed_cxt_tables_alloc()", " - ring-buffer: Fix reporting of missed events in iterator", " - vsock/vmci: fix UAF when peer resets connection during handshake", " - vsock/virtio: reset connection on receiving queue overflow", " - wifi: ath11k: clear shared SRNG pointer state on restart", " - ipv4: raw: reject IP_HDRINCL packets with ihl < 5", " - ixgbevf: fix use-after-free in VEPA multicast source pruning", " - ice: fix setting promisc mode while adding VID filter", " - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()", " - cifs: Fix busy dentry used after unmounting", " - tracing: Do not call map->ops->elt_free() if elt_alloc() fails", " - arm64: probes: Handle probes on hinted conditional branch instructions", " - KVM: arm64: vgic-its: Reject restored DTE with out-of-range", " num_eventid_bits", " - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe", " - spi: qup: fix error pointer deref after DMA setup failure", " - phy: tegra: xusb: Fix per-pad high-speed termination calibration", " - scsi: isci: Fix use-after-free in device removal path", " - spi: sprd: fix error pointer deref after DMA setup failure", " - spi: ti-qspi: fix use-after-free after DMA setup failure", " - RDMA/siw: Reject MPA FPDU length underflow before signed receive math", " - LoongArch: Remove unused code to avoid build warning", " - device property: set fwnode->secondary to NULL in fwnode_init()", " - drm/virtio: use uninterruptible resv lock for plane updates", " - drm/bridge: it66121: acquire reset GPIO in probe", " - drm/bridge: megachips: remove bridge when irq request fails", " - drm/amd/display: Fix integer overflow in bios_get_image()", " - drm/amd/display: Validate GPIO pin LUT table size before iterating", " - drm/amd/display: Validate payload length and link_index in", " dc_process_dmub_aux_transfer_async", " - batman-adv: mcast: fix use-after-free in orig_node RCU release", " - batman-adv: clear current gateway during teardown", " - batman-adv: dat: handle forward allocation error", " - batman-adv: fix tp_meter counter underflow during shutdown", " - batman-adv: frag: disallow unicast fragment in fragment", " - batman-adv: bla: fix report_work leak on backbone_gw purge", " - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown", " - batman-adv: tp_meter: fix race condition in send error reporting", " - batman-adv: tt: fix negative last_changeset_len", " - batman-adv: tt: fix negative tt_buff_len", " - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock", " - hwmon: (pmbus/adm1266) reject implausible blackbox record_count", " - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer", " - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized", " buffer", " - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR", " - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in", " get_multiple", " - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()", " - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()", " - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO", " accessors", " - HID: uclogic: Fix regression of input name assignment", " - firmware: arm_ffa: Check for NULL FF-A ID table while driver", " registration", " - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure", " - kunit: config: Enable KUNIT_DEBUGFS by default", " - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS", " - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150", " - ARM: integrator: Fix early initialization", " - ALSA: hda: cs35l56: Put ACPI device after setting companion", " - netfilter: x_tables: unregister the templates first", " - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()", " - test_kprobes: clear kprobes between test runs", " - tcp: Fix imbalanced icsk_accept_queue count.", " - ice: fix locking in ice_dcb_rebuild()", " - net: lan966x: avoid unregistering netdev on register failure", " - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register", " access", " - irqchip/ath79-cpu: Remove unused function", " - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT", " - zonefs: handle integer overflow in zonefs_fname_to_fno", " - netfs: Fix overrun check in netfs_extract_user_iter()", " - net: ethernet: cortina: Make RX SKB per-port", " - net: ethernet: cortina: Drop half-assembled SKB", " - net: ethernet: cortina: Carry over frag counter", " - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference", " - wifi: ath11k: fix error path leaks in some WMI WOW calls", " - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()", " - accel/qaic: Add overflow check to remap_pfn_range during mmap", " - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint", " - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics", " - drm/msm/dsi: don't dump registers past the mapped region", " - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN", " - powerpc/time: Remove redundant preempt_disable|enable() calls from", " arch_irq_work_raise()", " - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot", " - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring", " - net: tls: prevent chain-after-chain in plain text SG", " - net: phy: DP83TC811: add reading of abilities", " - x86/xen: Fix xen_e820_swap_entry_with_ram()", " - tls: Preserve sk_err across recvmsg() when data has been copied", " - net/mlx5: Do not restore destination-less TC rules", " - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()", " - drm/msm/snapshot: fix dumping of the unaligned regions", " - wifi: ath11k: fix peer resolution on rx path when peer_id=0", " - net: dsa: mt7530: fix FDB entries not aging out with short timeout", " - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw", " - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames", " - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer", " - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL", " - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL", " - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL", " - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL", " - RDMA/rtrs: Fix use-after-free in path file creation cleanup", " - net: bridge: Flush multicast groups when snooping is disabled", " - bridge: mcast: Fix a possible use-after-free when removing a bridge port", " - pds_core: fix error handling in pdsc_devcmd_wait", " - pds_core: fix debugfs_lookup dentry leak and error handling", " - ALSA: seq: ump: Use guard() for locking", " - ALSA: seq: Serialize UMP output teardown with event_input", " - Bluetooth: btmtk: add the function to get the fw name", " - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset", " - Bluetooth: btmtk: rename btmediatek_data", " - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c", " - Bluetooth: btmtk: fix urb->setup_packet leak in error paths", " - net: ag71xx: check error for platform_get_irq", " - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx", " - string: add mem_is_zero() helper to check if memory area is all zeros", " - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)", " - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed", " - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()", " - net: mana: validate rx_req_idx to prevent out-of-bounds array access", " - pds_core: ensure null-termination for firmware version strings", " - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions", " - security/keys: fix missed RCU read section on lookup", " - ata: libata-scsi: improve readability of ata_scsi_qc_issue()", " - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT", " - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS", " - ata: libata-scsi: do not needlessly defer commands when using PMP with", " FBS", " - perf parse-events: Expose/rename config_term_name", " - net/mlx5e: Trigger neighbor resolution for unresolved destinations", " - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC", " init", " - ksmbd: validate SID in parent security descriptor during ACL inheritance", " - smb: client: require net admin for CIFS SWN netlink", " - smb: client: use data_len for SMB2 READ encrypted folioq copy", " - mm/memory_hotplug: fix memory block reference leak on remove", " - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer", " - cgroup/cpuset: Reset DL migration state on can_attach() failure", " - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()", " - lsm: hold cred_guard_mutex for lsm_set_self_attr()", " - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index", " - ice: restore PTP Rx timestamp config after ethtool set-channels", " - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()", " - ARM: dts: renesas: genmai: Drop superfluous cells", " - ARM: dts: renesas: rskrza1: Drop superfluous cells", " - riscv: mm: Fixup no5lvl failure when vaddr is invalid", " - ALSA: hda: cs35l41: Put ACPI device on missing physical node", " - ice: fix setting RSS VSI hash for E830", " - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().", " - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST", " - netfs: Fix trimming of streaming-write folios in netfs_inval_folio()", " - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes", " gone", " - wifi: ath10k: skip WMI and beacon transmission when device is wedged", " - scsi: sd: Fix return code handling in sd_spinup_disk()", " - ALSA: scarlett2: Add missing error check when initialise Autogain Status", " - btrfs: fix squota accounting during enable generation", " - landlock: Fix TCP handling of short AF_UNSPEC addresses", " - Upstream stable to v6.6.142, v6.12.92", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2025-71289", " - fs/ntfs3: handle attr_set_size() errors when truncating files", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46315", " - io_uring/waitid: clear waitid info before copying it to userspace", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31486", " - hwmon: (pmbus/core) Protect regulator operations with mutex", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-23469", " - drm/imagination: Synchronize interrupts before suspending the GPU", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31560", " - spi: spi-dw-dma: fix print error log when wait finish transaction", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31420", " - bridge: mrp: reject zero test interval to avoid OOM panic", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46275", " - Bluetooth: hci_uart: fix UAFs and race conditions in close and init", " paths", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46170", " - mptcp: pm: ADD_ADDR rtx: free sk if last", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46158", " - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-46242", " - eventpoll: fix ep_remove struct eventpoll / struct file UAF", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-52931", " - batman-adv: tp_meter: avoid use of uninit sender vars", "", " * CVE-2026-52914", " - batman-adv: fix fragment reassembly length accounting", "", " * CVE-2026-46325", " - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE", "", " * CVE-2026-43465", " - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ", "", " * CVE-2026-43198", " - tcp: fix potential race in tcp_v6_syn_recv_sock()", "", " * CVE-2026-43197", " - netconsole: avoid OOB reads, msg is not nul-terminated", "", " * CVE-2026-43083", " - net: ioam6: fix OOB and missing lock", "" ], "package": "linux", "version": "6.8.0-139.139", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162466, 1786013, 2072994, 2159608, 2160302, 2158920, 2139686, 2158462, 2155609, 2142613, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:25:37 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-common", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-139.139", "version": "6.8.0-139.139" }, "cves": [ { "cve": "CVE-2025-71289", "url": "https://ubuntu.com/security/CVE-2025-71289", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.", "cve_priority": "medium", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-46315", "url": "https://ubuntu.com/security/CVE-2026-46315", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it does not initialize info itself. If the wait operation completes without reporting a child event, the common wait code can return without writing wo_info. In that case io_waitid_finish() still copies iw->info to userspace, exposing stale bytes from the reused io_kiocb command storage. Clear the result storage during prep so the io_uring path matches the regular waitid syscall, which uses a zero-initialized struct waitid_info.", "cve_priority": "medium", "cve_public_date": "2026-06-09 09:16:00 UTC" }, { "cve": "CVE-2026-31486", "url": "https://ubuntu.com/security/CVE-2026-31486", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h.", "cve_priority": "medium", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-23469", "url": "https://ubuntu.com/security/CVE-2026-23469", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU core and doesn't wait for it to finish. Depending on timing, the IRQ handler could be running while the GPU is suspended, leading to kernel crashes when trying to access GPU registers. See example signature below. In a power off sequence initiated by the runtime PM suspend callback, wait for any IRQ handlers in progress on other CPU cores to finish, by calling synchronize_irq(). At the same time, remove the runtime PM resume/put calls in the threaded IRQ handler. On top of not being the right approach to begin with, and being at the wrong place as they should have wrapped all GPU register accesses, the driver would hit a deadlock between synchronize_irq() being called from a runtime PM suspend callback, holding the device power lock, and the resume callback requiring the same. Example crash signature on a TI AM68 SK platform: [ 337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError [ 337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241246] Tainted: [M]=MACHINE_CHECK [ 337.241249] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 337.241256] pc : pvr_riscv_irq_pending+0xc/0x24 [ 337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310 [ 337.241282] sp : ffff800085b0bd30 [ 337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10 [ 337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000 [ 337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30 [ 337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001 [ 337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40 [ 337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a [ 337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00 [ 337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003 [ 337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000 [ 337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000 [ 337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt [ 337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241342] Tainted: [M]=MACHINE_CHECK [ 337.241343] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241345] Call trace: [ 337.241348] show_stack+0x18/0x24 (C) [ 337.241357] dump_stack_lvl+0x60/0x80 [ 337.241364] dump_stack+0x18/0x24 [ 337.241368] vpanic+0x124/0x2ec [ 337.241373] abort+0x0/0x4 [ 337.241377] add_taint+0x0/0xbc [ 337.241384] arm64_serror_panic+0x70/0x80 [ 337.241389] do_serror+0x3c/0x74 [ 337.241392] el1h_64_error_handler+0x30/0x48 [ 337.241400] el1h_64_error+0x6c/0x70 [ 337.241404] pvr_riscv_irq_pending+0xc/0x24 (P) [ 337.241410] irq_thread_fn+0x2c/0xb0 [ 337.241416] irq_thread+0x170/0x334 [ 337.241421] kthread+0x12c/0x210 [ 337.241428] ret_from_fork+0x10/0x20 [ 337.241434] SMP: stopping secondary CPUs [ 337.241451] Kernel Offset: disabled [ 337.241453] CPU features: 0x040000,02002800,20002001,0400421b [ 337.241456] Memory Limit: none [ 337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---", "cve_priority": "medium", "cve_public_date": "2026-04-03 16:16:00 UTC" }, { "cve": "CVE-2026-31560", "url": "https://ubuntu.com/security/CVE-2026-31560", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: spi: spi-dw-dma: fix print error log when wait finish transaction If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*).", "cve_priority": "medium", "cve_public_date": "2026-04-24 15:16:00 UTC" }, { "cve": "CVE-2026-31420", "url": "https://ubuntu.com/security/CVE-2026-31420", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.", "cve_priority": "medium", "cve_public_date": "2026-04-13 14:16:00 UTC" }, { "cve": "CVE-2026-46275", "url": "https://ubuntu.com/security/CVE-2026-46275", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.", "cve_priority": "high", "cve_public_date": "2026-06-08 16:16:00 UTC" }, { "cve": "CVE-2026-46170", "url": "https://ubuntu.com/security/CVE-2026-46170", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on \"itself\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-46158", "url": "https://ubuntu.com/security/CVE-2026-46158", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as \"unlikely\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46242", "url": "https://ubuntu.com/security/CVE-2026-46242", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.", "cve_priority": "high", "cve_public_date": "2026-05-30 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52931", "url": "https://ubuntu.com/security/CVE-2026-52931", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-52914", "url": "https://ubuntu.com/security/CVE-2026-52914", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-46325", "url": "https://ubuntu.com/security/CVE-2026-46325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/", "cve_priority": "low", "cve_public_date": "2026-06-09 14:16:00 UTC" }, { "cve": "CVE-2026-43465", "url": "https://ubuntu.com/security/CVE-2026-43465", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb: - The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0. - The test sends one packet with no payload. - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above. - The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain more data, the program drops the tail fragment since it no longer contains any payload (pp_ref_count=63). - mlx5 device skips counting this fragment. Internal frag counter remains 0. - mlx5 releases all 64 fragments of the page but page pp_ref_count is 63 => negative reference counting error. Resulting splat during the test: WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] Modules linked in: [...] CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] [...] Call Trace: mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] mlx5e_close_rq+0x78/0xa0 [mlx5_core] mlx5e_close_queues+0x46/0x2a0 [mlx5_core] mlx5e_close_channel+0x24/0x90 [mlx5_core] mlx5e_close_channels+0x5d/0xf0 [mlx5_core] mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] mlx5e_change_mtu+0x11d/0x490 [mlx5_core] mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] netif_set_mtu_ext+0xfc/0x240 do_setlink.isra.0+0x226/0x1100 rtnl_newlink+0x7a9/0xba0 rtnetlink_rcv_msg+0x220/0x3c0 netlink_rcv_skb+0x4b/0xf0 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x240 ___sys_sendmsg+0x7c/0xb0 [...] __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xc70 The problem applies for XDP_PASS as well which is handled in a different code path in the driver. This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag. As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags.", "cve_priority": "low", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43197", "url": "https://ubuntu.com/security/CVE-2026-43197", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)", "cve_priority": "negligible", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43083", "url": "https://ubuntu.com/security/CVE-2026-43083", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.", "cve_priority": "high", "cve_public_date": "2026-05-06 10:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162466, 1786013, 2072994, 2159608, 2160302, 2158920, 2139686, 2158462, 2155609, 2142613, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250 ], "changes": [ { "cves": [ { "cve": "CVE-2025-71289", "url": "https://ubuntu.com/security/CVE-2025-71289", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.", "cve_priority": "medium", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-46315", "url": "https://ubuntu.com/security/CVE-2026-46315", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it does not initialize info itself. If the wait operation completes without reporting a child event, the common wait code can return without writing wo_info. In that case io_waitid_finish() still copies iw->info to userspace, exposing stale bytes from the reused io_kiocb command storage. Clear the result storage during prep so the io_uring path matches the regular waitid syscall, which uses a zero-initialized struct waitid_info.", "cve_priority": "medium", "cve_public_date": "2026-06-09 09:16:00 UTC" }, { "cve": "CVE-2026-31486", "url": "https://ubuntu.com/security/CVE-2026-31486", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h.", "cve_priority": "medium", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-23469", "url": "https://ubuntu.com/security/CVE-2026-23469", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU core and doesn't wait for it to finish. Depending on timing, the IRQ handler could be running while the GPU is suspended, leading to kernel crashes when trying to access GPU registers. See example signature below. In a power off sequence initiated by the runtime PM suspend callback, wait for any IRQ handlers in progress on other CPU cores to finish, by calling synchronize_irq(). At the same time, remove the runtime PM resume/put calls in the threaded IRQ handler. On top of not being the right approach to begin with, and being at the wrong place as they should have wrapped all GPU register accesses, the driver would hit a deadlock between synchronize_irq() being called from a runtime PM suspend callback, holding the device power lock, and the resume callback requiring the same. Example crash signature on a TI AM68 SK platform: [ 337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError [ 337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241246] Tainted: [M]=MACHINE_CHECK [ 337.241249] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 337.241256] pc : pvr_riscv_irq_pending+0xc/0x24 [ 337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310 [ 337.241282] sp : ffff800085b0bd30 [ 337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10 [ 337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000 [ 337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30 [ 337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001 [ 337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40 [ 337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a [ 337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00 [ 337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003 [ 337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000 [ 337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000 [ 337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt [ 337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241342] Tainted: [M]=MACHINE_CHECK [ 337.241343] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241345] Call trace: [ 337.241348] show_stack+0x18/0x24 (C) [ 337.241357] dump_stack_lvl+0x60/0x80 [ 337.241364] dump_stack+0x18/0x24 [ 337.241368] vpanic+0x124/0x2ec [ 337.241373] abort+0x0/0x4 [ 337.241377] add_taint+0x0/0xbc [ 337.241384] arm64_serror_panic+0x70/0x80 [ 337.241389] do_serror+0x3c/0x74 [ 337.241392] el1h_64_error_handler+0x30/0x48 [ 337.241400] el1h_64_error+0x6c/0x70 [ 337.241404] pvr_riscv_irq_pending+0xc/0x24 (P) [ 337.241410] irq_thread_fn+0x2c/0xb0 [ 337.241416] irq_thread+0x170/0x334 [ 337.241421] kthread+0x12c/0x210 [ 337.241428] ret_from_fork+0x10/0x20 [ 337.241434] SMP: stopping secondary CPUs [ 337.241451] Kernel Offset: disabled [ 337.241453] CPU features: 0x040000,02002800,20002001,0400421b [ 337.241456] Memory Limit: none [ 337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---", "cve_priority": "medium", "cve_public_date": "2026-04-03 16:16:00 UTC" }, { "cve": "CVE-2026-31560", "url": "https://ubuntu.com/security/CVE-2026-31560", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: spi: spi-dw-dma: fix print error log when wait finish transaction If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*).", "cve_priority": "medium", "cve_public_date": "2026-04-24 15:16:00 UTC" }, { "cve": "CVE-2026-31420", "url": "https://ubuntu.com/security/CVE-2026-31420", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.", "cve_priority": "medium", "cve_public_date": "2026-04-13 14:16:00 UTC" }, { "cve": "CVE-2026-46275", "url": "https://ubuntu.com/security/CVE-2026-46275", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.", "cve_priority": "high", "cve_public_date": "2026-06-08 16:16:00 UTC" }, { "cve": "CVE-2026-46170", "url": "https://ubuntu.com/security/CVE-2026-46170", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on \"itself\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-46158", "url": "https://ubuntu.com/security/CVE-2026-46158", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as \"unlikely\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46242", "url": "https://ubuntu.com/security/CVE-2026-46242", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.", "cve_priority": "high", "cve_public_date": "2026-05-30 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52931", "url": "https://ubuntu.com/security/CVE-2026-52931", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-52914", "url": "https://ubuntu.com/security/CVE-2026-52914", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-46325", "url": "https://ubuntu.com/security/CVE-2026-46325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/", "cve_priority": "low", "cve_public_date": "2026-06-09 14:16:00 UTC" }, { "cve": "CVE-2026-43465", "url": "https://ubuntu.com/security/CVE-2026-43465", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb: - The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0. - The test sends one packet with no payload. - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above. - The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain more data, the program drops the tail fragment since it no longer contains any payload (pp_ref_count=63). - mlx5 device skips counting this fragment. Internal frag counter remains 0. - mlx5 releases all 64 fragments of the page but page pp_ref_count is 63 => negative reference counting error. Resulting splat during the test: WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] Modules linked in: [...] CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] [...] Call Trace: mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] mlx5e_close_rq+0x78/0xa0 [mlx5_core] mlx5e_close_queues+0x46/0x2a0 [mlx5_core] mlx5e_close_channel+0x24/0x90 [mlx5_core] mlx5e_close_channels+0x5d/0xf0 [mlx5_core] mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] mlx5e_change_mtu+0x11d/0x490 [mlx5_core] mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] netif_set_mtu_ext+0xfc/0x240 do_setlink.isra.0+0x226/0x1100 rtnl_newlink+0x7a9/0xba0 rtnetlink_rcv_msg+0x220/0x3c0 netlink_rcv_skb+0x4b/0xf0 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x240 ___sys_sendmsg+0x7c/0xb0 [...] __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xc70 The problem applies for XDP_PASS as well which is handled in a different code path in the driver. This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag. As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags.", "cve_priority": "low", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43197", "url": "https://ubuntu.com/security/CVE-2026-43197", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)", "cve_priority": "negligible", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43083", "url": "https://ubuntu.com/security/CVE-2026-43083", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.", "cve_priority": "high", "cve_public_date": "2026-05-06 10:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-139.139 -proposed tracker (LP: #2162466)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " - [Packaging] debian.master/dkms-versions -- update from kernel-versions", " (main/2026.08.03)", "", " * kselftests_net.net:test_bpf.sh fails on ppc64el (LP: #2072994)", " - powerpc64/bpf: jit support for 32bit offset jmp instruction", " - powerpc64/bpf: jit support for unconditional byte swap", " - powerpc64/bpf: jit support for sign extended load", " - powerpc64/bpf: jit support for sign extended mov", " - powerpc64/bpf: jit support for signed division and modulo", "", " * noble/linux-raspi FTBFS: bcmasp phylib managed-EEE backport missing", " prerequisites (LP: #2159608)", " - SAUCE: Revert \"net: bcm: asp2: convert to phylib managed EEE\"", " - SAUCE: Revert \"net: bcm: asp2: remove tx_lpi_enabled\"", " - SAUCE: Revert \"net: bcm: asp2: fix LPI timer handling\"", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * noble-stable-2026-06-16 dropped a bracket causing FTBFS (LP: #2158920)", " - SAUCE: drm/v3d: Fix bracket drop FTBFS for non-generic kernels", "", " * ubuntu_bpf failed to build on Noble ( error: ‘XDP_UMEM_TX_METADATA_LEN’", " undeclared ) (LP: #2139686)", " - selftests/bpf: Add XDP_UMEM_TX_METADATA_LEN to XSK TX metadata test", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * net/tls: Three upstream fixes without CVE missing from Ubuntu", " 6.8.0-124-generic (LP: #2155609)", " - net: tls: fix silent data drop under pipe back-pressure", "", " * net:fcnal-test.sh fails because it can't find wait_local_port_listen on", " noble (LP: #2142613)", " - selftests: net: move wait_local_port_listen to lib.sh", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250)", " - mptcp: sync the msk->sndbuf at accept() time", " - mptcp: pm: ADD_ADDR rtx: allow ID 0", " - s390/debug: Reject zero-length input before trimming a newline", " - Revert \"x86/vdso: Fix output operand size of RDPID\"", " - Revert \"s390/cio: Update purge function to unregister the unused", " subchannels\"", " - sysfs: don't remove existing directory on update failure", " - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()", " - smb: client: protect tc_count increment in", " smb2_find_smb_sess_tcon_unlocked()", " - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close", " - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX", " - ALSA: ua101: Reject too-short USB descriptors", " - ALSA: pcm: Don't setup bogus iov_iter for silencing", " - ALSA: asihpi: Fix potential OOB array access at reading cache", " - efi: Allocate runtime workqueue before ACPI init", " - drivers/base/memory: fix memory block reference leak in poison", " accounting", " - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()", " - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()", " - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START", " - Bluetooth: bnep: Fix UAF read of dev->name", " - Bluetooth: MGMT: validate Add Extended Advertising Data length", " - Bluetooth: serialize accept_q access", " - phonet/pep: disable BH around forwarded sk_receive_skb()", " - net: bcmgenet: keep RBUF EEE/PM disabled", " - net: ifb: report ethtool stats over num_tx_queues", " - netfilter: ip6t_hbh: reject oversized option lists", " - netfilter: nf_queue: hold bridge skb->dev while queued", " - netfilter: ipset: stop hash:* range iteration at end", " - qed: fix double free in qed_cxt_tables_alloc()", " - ring-buffer: Fix reporting of missed events in iterator", " - vsock/vmci: fix UAF when peer resets connection during handshake", " - vsock/virtio: reset connection on receiving queue overflow", " - wifi: ath11k: clear shared SRNG pointer state on restart", " - ipv4: raw: reject IP_HDRINCL packets with ihl < 5", " - ixgbevf: fix use-after-free in VEPA multicast source pruning", " - ice: fix setting promisc mode while adding VID filter", " - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()", " - cifs: Fix busy dentry used after unmounting", " - tracing: Do not call map->ops->elt_free() if elt_alloc() fails", " - arm64: probes: Handle probes on hinted conditional branch instructions", " - KVM: arm64: vgic-its: Reject restored DTE with out-of-range", " num_eventid_bits", " - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe", " - spi: qup: fix error pointer deref after DMA setup failure", " - phy: tegra: xusb: Fix per-pad high-speed termination calibration", " - scsi: isci: Fix use-after-free in device removal path", " - spi: sprd: fix error pointer deref after DMA setup failure", " - spi: ti-qspi: fix use-after-free after DMA setup failure", " - RDMA/siw: Reject MPA FPDU length underflow before signed receive math", " - LoongArch: Remove unused code to avoid build warning", " - device property: set fwnode->secondary to NULL in fwnode_init()", " - drm/virtio: use uninterruptible resv lock for plane updates", " - drm/bridge: it66121: acquire reset GPIO in probe", " - drm/bridge: megachips: remove bridge when irq request fails", " - drm/amd/display: Fix integer overflow in bios_get_image()", " - drm/amd/display: Validate GPIO pin LUT table size before iterating", " - drm/amd/display: Validate payload length and link_index in", " dc_process_dmub_aux_transfer_async", " - batman-adv: mcast: fix use-after-free in orig_node RCU release", " - batman-adv: clear current gateway during teardown", " - batman-adv: dat: handle forward allocation error", " - batman-adv: fix tp_meter counter underflow during shutdown", " - batman-adv: frag: disallow unicast fragment in fragment", " - batman-adv: bla: fix report_work leak on backbone_gw purge", " - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown", " - batman-adv: tp_meter: fix race condition in send error reporting", " - batman-adv: tt: fix negative last_changeset_len", " - batman-adv: tt: fix negative tt_buff_len", " - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock", " - hwmon: (pmbus/adm1266) reject implausible blackbox record_count", " - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer", " - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized", " buffer", " - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR", " - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in", " get_multiple", " - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()", " - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()", " - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO", " accessors", " - HID: uclogic: Fix regression of input name assignment", " - firmware: arm_ffa: Check for NULL FF-A ID table while driver", " registration", " - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure", " - kunit: config: Enable KUNIT_DEBUGFS by default", " - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS", " - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150", " - ARM: integrator: Fix early initialization", " - ALSA: hda: cs35l56: Put ACPI device after setting companion", " - netfilter: x_tables: unregister the templates first", " - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()", " - test_kprobes: clear kprobes between test runs", " - tcp: Fix imbalanced icsk_accept_queue count.", " - ice: fix locking in ice_dcb_rebuild()", " - net: lan966x: avoid unregistering netdev on register failure", " - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register", " access", " - irqchip/ath79-cpu: Remove unused function", " - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT", " - zonefs: handle integer overflow in zonefs_fname_to_fno", " - netfs: Fix overrun check in netfs_extract_user_iter()", " - net: ethernet: cortina: Make RX SKB per-port", " - net: ethernet: cortina: Drop half-assembled SKB", " - net: ethernet: cortina: Carry over frag counter", " - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference", " - wifi: ath11k: fix error path leaks in some WMI WOW calls", " - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()", " - accel/qaic: Add overflow check to remap_pfn_range during mmap", " - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint", " - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics", " - drm/msm/dsi: don't dump registers past the mapped region", " - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN", " - powerpc/time: Remove redundant preempt_disable|enable() calls from", " arch_irq_work_raise()", " - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot", " - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring", " - net: tls: prevent chain-after-chain in plain text SG", " - net: phy: DP83TC811: add reading of abilities", " - x86/xen: Fix xen_e820_swap_entry_with_ram()", " - tls: Preserve sk_err across recvmsg() when data has been copied", " - net/mlx5: Do not restore destination-less TC rules", " - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()", " - drm/msm/snapshot: fix dumping of the unaligned regions", " - wifi: ath11k: fix peer resolution on rx path when peer_id=0", " - net: dsa: mt7530: fix FDB entries not aging out with short timeout", " - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw", " - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames", " - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer", " - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL", " - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL", " - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL", " - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL", " - RDMA/rtrs: Fix use-after-free in path file creation cleanup", " - net: bridge: Flush multicast groups when snooping is disabled", " - bridge: mcast: Fix a possible use-after-free when removing a bridge port", " - pds_core: fix error handling in pdsc_devcmd_wait", " - pds_core: fix debugfs_lookup dentry leak and error handling", " - ALSA: seq: ump: Use guard() for locking", " - ALSA: seq: Serialize UMP output teardown with event_input", " - Bluetooth: btmtk: add the function to get the fw name", " - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset", " - Bluetooth: btmtk: rename btmediatek_data", " - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c", " - Bluetooth: btmtk: fix urb->setup_packet leak in error paths", " - net: ag71xx: check error for platform_get_irq", " - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx", " - string: add mem_is_zero() helper to check if memory area is all zeros", " - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)", " - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed", " - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()", " - net: mana: validate rx_req_idx to prevent out-of-bounds array access", " - pds_core: ensure null-termination for firmware version strings", " - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions", " - security/keys: fix missed RCU read section on lookup", " - ata: libata-scsi: improve readability of ata_scsi_qc_issue()", " - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT", " - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS", " - ata: libata-scsi: do not needlessly defer commands when using PMP with", " FBS", " - perf parse-events: Expose/rename config_term_name", " - net/mlx5e: Trigger neighbor resolution for unresolved destinations", " - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC", " init", " - ksmbd: validate SID in parent security descriptor during ACL inheritance", " - smb: client: require net admin for CIFS SWN netlink", " - smb: client: use data_len for SMB2 READ encrypted folioq copy", " - mm/memory_hotplug: fix memory block reference leak on remove", " - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer", " - cgroup/cpuset: Reset DL migration state on can_attach() failure", " - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()", " - lsm: hold cred_guard_mutex for lsm_set_self_attr()", " - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index", " - ice: restore PTP Rx timestamp config after ethtool set-channels", " - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()", " - ARM: dts: renesas: genmai: Drop superfluous cells", " - ARM: dts: renesas: rskrza1: Drop superfluous cells", " - riscv: mm: Fixup no5lvl failure when vaddr is invalid", " - ALSA: hda: cs35l41: Put ACPI device on missing physical node", " - ice: fix setting RSS VSI hash for E830", " - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().", " - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST", " - netfs: Fix trimming of streaming-write folios in netfs_inval_folio()", " - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes", " gone", " - wifi: ath10k: skip WMI and beacon transmission when device is wedged", " - scsi: sd: Fix return code handling in sd_spinup_disk()", " - ALSA: scarlett2: Add missing error check when initialise Autogain Status", " - btrfs: fix squota accounting during enable generation", " - landlock: Fix TCP handling of short AF_UNSPEC addresses", " - Upstream stable to v6.6.142, v6.12.92", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2025-71289", " - fs/ntfs3: handle attr_set_size() errors when truncating files", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46315", " - io_uring/waitid: clear waitid info before copying it to userspace", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31486", " - hwmon: (pmbus/core) Protect regulator operations with mutex", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-23469", " - drm/imagination: Synchronize interrupts before suspending the GPU", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31560", " - spi: spi-dw-dma: fix print error log when wait finish transaction", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31420", " - bridge: mrp: reject zero test interval to avoid OOM panic", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46275", " - Bluetooth: hci_uart: fix UAFs and race conditions in close and init", " paths", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46170", " - mptcp: pm: ADD_ADDR rtx: free sk if last", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46158", " - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-46242", " - eventpoll: fix ep_remove struct eventpoll / struct file UAF", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-52931", " - batman-adv: tp_meter: avoid use of uninit sender vars", "", " * CVE-2026-52914", " - batman-adv: fix fragment reassembly length accounting", "", " * CVE-2026-46325", " - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE", "", " * CVE-2026-43465", " - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ", "", " * CVE-2026-43198", " - tcp: fix potential race in tcp_v6_syn_recv_sock()", "", " * CVE-2026-43197", " - netconsole: avoid OOB reads, msg is not nul-terminated", "", " * CVE-2026-43083", " - net: ioam6: fix OOB and missing lock", "" ], "package": "linux", "version": "6.8.0-139.139", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162466, 1786013, 2072994, 2159608, 2160302, 2158920, 2139686, 2158462, 2155609, 2142613, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:25:37 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-virtual", "from_version": { "source_package_name": "linux-meta-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": "7.0.0-28.28.1~24.04.3" }, "to_version": { "source_package_name": "linux-meta-riscv-7.0", "source_package_version": "7.0.0-31.31.1~24.04.1+1", "version": "7.0.0-31.31.1~24.04.1+1" }, "cves": [], "launchpad_bugs_fixed": [ 1975592, 1786013 ], "changes": [ { "cves": [], "log": [ "", "", " * Enable Nezha board (LP: #1975592)", " - [Packaging] Add allwinner transitionals", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1+1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1975592 ], "author": "Sarah Emery ", "date": "Wed, 26 Aug 2026 13:12:13 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31.1~24.04.1", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Mon, 24 Aug 2026 10:39:35 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-30.30.1~24.04.1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta-riscv-7.0", "version": "7.0.0-30.30.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Fri, 21 Aug 2026 15:20:27 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "locales", "from_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.8", "version": "2.39-0ubuntu8.8" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.9", "version": "2.39-0ubuntu8.9" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.39-0ubuntu8.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:15:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "motd-news-config", "from_version": { "source_package_name": "base-files", "source_package_version": "13ubuntu10.4", "version": "13ubuntu10.4" }, "to_version": { "source_package_name": "base-files", "source_package_version": "13ubuntu10.5", "version": "13ubuntu10.5" }, "cves": [], "launchpad_bugs_fixed": [ 2166604 ], "changes": [ { "cves": [], "log": [ "", " * /etc/issue{,.net}, /etc/{lsb,os}-release: bump version to 24.04.5", " (LP: #2166604)", "" ], "package": "base-files", "version": "13ubuntu10.5", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2166604 ], "author": "Graham Inggs ", "date": "Sun, 06 Sep 2026 14:29:43 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "mount", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ncurses-base", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ncurses-bin", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ncurses-term", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.18", "version": "1:9.6p1-3ubuntu13.18" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.19", "version": "1:9.6p1-3ubuntu13.19" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:9.6p1-3ubuntu13.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:38:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.18", "version": "1:9.6p1-3ubuntu13.18" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.19", "version": "1:9.6p1-3ubuntu13.19" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:9.6p1-3ubuntu13.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:38:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.18", "version": "1:9.6p1-3ubuntu13.18" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.19", "version": "1:9.6p1-3ubuntu13.19" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:9.6p1-3ubuntu13.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:38:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl", "from_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.3", "version": "5.38.2-3.2ubuntu0.3" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.4", "version": "5.38.2-3.2ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", " [ LeoSilva ]", " * SECURITY UPDATE: uncaught exception in IO::Uncompress::Unzip DOS date", " parsing", " - debian/patches/CVE-2025-15649.patch: wrap _dosToUnixTime() in eval", " and return zero for empty/out-of-range date fields in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2025-15649", " [ LeoSilva ]", " * SECURITY UPDATE: CPU exhaustion in IO::Uncompress::Unzip fastForward", " - debian/patches/CVE-2026-48959.patch: fix per-byte read loop caused", " by comparing length $offset instead of $offset in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2026-48959", " [ LeoSilva ]", " * SECURITY UPDATE: arbitrary code execution in File::GlobMapper", " - debian/patches/CVE-2026-48962.patch: remove use of eval STRING in", " _parseOutputGlob/_getFiles, replacing with safe delimiter-based", " substitution in cpan/IO-Compress/lib/File/GlobMapper.pm", " - CVE-2026-48962", " [ LeoSilva ]", " * SECURITY UPDATE: credential header leakage on cross-origin redirects", " in HTTP::Tiny", " - debian/patches/CVE-2026-7017.patch: strip Authorization, Cookie and", " Proxy-Authorization headers on cross-origin redirects, refuse", " https-to-http downgrade by default in", " cpan/HTTP-Tiny/lib/HTTP/Tiny.pm", " - CVE-2026-7017", " [ LeoSilva ]", " * SECURITY UPDATE: memory exhaustion in Archive::Tar entry size handling", " - debian/patches/CVE-2026-9538.patch: add $MAX_FILE_SIZE cap to", " refuse oversized entry declarations before allocation in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-9538", "" ], "package": "perl", "version": "5.38.2-3.2ubuntu0.4", "urgency": "high", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 18 Aug 2026 17:25:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.3", "version": "5.38.2-3.2ubuntu0.3" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.4", "version": "5.38.2-3.2ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", " [ LeoSilva ]", " * SECURITY UPDATE: uncaught exception in IO::Uncompress::Unzip DOS date", " parsing", " - debian/patches/CVE-2025-15649.patch: wrap _dosToUnixTime() in eval", " and return zero for empty/out-of-range date fields in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2025-15649", " [ LeoSilva ]", " * SECURITY UPDATE: CPU exhaustion in IO::Uncompress::Unzip fastForward", " - debian/patches/CVE-2026-48959.patch: fix per-byte read loop caused", " by comparing length $offset instead of $offset in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2026-48959", " [ LeoSilva ]", " * SECURITY UPDATE: arbitrary code execution in File::GlobMapper", " - debian/patches/CVE-2026-48962.patch: remove use of eval STRING in", " _parseOutputGlob/_getFiles, replacing with safe delimiter-based", " substitution in cpan/IO-Compress/lib/File/GlobMapper.pm", " - CVE-2026-48962", " [ LeoSilva ]", " * SECURITY UPDATE: credential header leakage on cross-origin redirects", " in HTTP::Tiny", " - debian/patches/CVE-2026-7017.patch: strip Authorization, Cookie and", " Proxy-Authorization headers on cross-origin redirects, refuse", " https-to-http downgrade by default in", " cpan/HTTP-Tiny/lib/HTTP/Tiny.pm", " - CVE-2026-7017", " [ LeoSilva ]", " * SECURITY UPDATE: memory exhaustion in Archive::Tar entry size handling", " - debian/patches/CVE-2026-9538.patch: add $MAX_FILE_SIZE cap to", " refuse oversized entry declarations before allocation in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-9538", "" ], "package": "perl", "version": "5.38.2-3.2ubuntu0.4", "urgency": "high", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 18 Aug 2026 17:25:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-modules-5.38", "from_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.3", "version": "5.38.2-3.2ubuntu0.3" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.4", "version": "5.38.2-3.2ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", " [ LeoSilva ]", " * SECURITY UPDATE: uncaught exception in IO::Uncompress::Unzip DOS date", " parsing", " - debian/patches/CVE-2025-15649.patch: wrap _dosToUnixTime() in eval", " and return zero for empty/out-of-range date fields in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2025-15649", " [ LeoSilva ]", " * SECURITY UPDATE: CPU exhaustion in IO::Uncompress::Unzip fastForward", " - debian/patches/CVE-2026-48959.patch: fix per-byte read loop caused", " by comparing length $offset instead of $offset in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2026-48959", " [ LeoSilva ]", " * SECURITY UPDATE: arbitrary code execution in File::GlobMapper", " - debian/patches/CVE-2026-48962.patch: remove use of eval STRING in", " _parseOutputGlob/_getFiles, replacing with safe delimiter-based", " substitution in cpan/IO-Compress/lib/File/GlobMapper.pm", " - CVE-2026-48962", " [ LeoSilva ]", " * SECURITY UPDATE: credential header leakage on cross-origin redirects", " in HTTP::Tiny", " - debian/patches/CVE-2026-7017.patch: strip Authorization, Cookie and", " Proxy-Authorization headers on cross-origin redirects, refuse", " https-to-http downgrade by default in", " cpan/HTTP-Tiny/lib/HTTP/Tiny.pm", " - CVE-2026-7017", " [ LeoSilva ]", " * SECURITY UPDATE: memory exhaustion in Archive::Tar entry size handling", " - debian/patches/CVE-2026-9538.patch: add $MAX_FILE_SIZE cap to", " refuse oversized entry declarations before allocation in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-9538", "" ], "package": "perl", "version": "5.38.2-3.2ubuntu0.4", "urgency": "high", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 18 Aug 2026 17:25:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python-apt-common", "from_version": { "source_package_name": "python-apt", "source_package_version": "2.7.7ubuntu5.2", "version": "2.7.7ubuntu5.2" }, "to_version": { "source_package_name": "python-apt", "source_package_version": "2.7.7ubuntu5.3", "version": "2.7.7ubuntu5.3" }, "cves": [], "launchpad_bugs_fixed": [ 2166601 ], "changes": [ { "cves": [], "log": [ "", " * Mirror list update for 24.04.5 (LP: #2166601)", "" ], "package": "python-apt", "version": "2.7.7ubuntu5.3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2166601 ], "author": "Graham Inggs ", "date": "Sun, 06 Sep 2026 14:01:38 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-apt", "from_version": { "source_package_name": "python-apt", "source_package_version": "2.7.7ubuntu5.2", "version": "2.7.7ubuntu5.2" }, "to_version": { "source_package_name": "python-apt", "source_package_version": "2.7.7ubuntu5.3", "version": "2.7.7ubuntu5.3" }, "cves": [], "launchpad_bugs_fixed": [ 2166601 ], "changes": [ { "cves": [], "log": [ "", " * Mirror list update for 24.04.5 (LP: #2166601)", "" ], "package": "python-apt", "version": "2.7.7ubuntu5.3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2166601 ], "author": "Graham Inggs ", "date": "Sun, 06 Sep 2026 14:01:38 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-distupgrade", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:24.04.28", "version": "1:24.04.28" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:24.04.29", "version": "1:24.04.29" }, "cves": [], "launchpad_bugs_fixed": [ 2078579, 2166415 ], "changes": [ { "cves": [], "log": [ "", " * Install dependencies of t64 packages (LP: #2078579)", " * Run pre-build.sh: updating mirrors (and .po offsets) for point release.", " (LP: #2166415)", "" ], "package": "ubuntu-release-upgrader", "version": "1:24.04.29", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2078579, 2166415 ], "author": "Julian Andres Klode ", "date": "Thu, 03 Sep 2026 23:11:07 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-pyasn1", "from_version": { "source_package_name": "pyasn1", "source_package_version": "0.4.8-4ubuntu0.2", "version": "0.4.8-4ubuntu0.2" }, "to_version": { "source_package_name": "pyasn1", "source_package_version": "0.4.8-4ubuntu0.3", "version": "0.4.8-4ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-59886", "url": "https://ubuntu.com/security/CVE-2026-59886", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59884", "url": "https://ubuntu.com/security/CVE-2026-59884", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59885", "url": "https://ubuntu.com/security/CVE-2026-59885", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59886", "url": "https://ubuntu.com/security/CVE-2026-59886", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59884", "url": "https://ubuntu.com/security/CVE-2026-59884", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59885", "url": "https://ubuntu.com/security/CVE-2026-59885", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pyasn1 BER/CER/DER decoder denial of service via", " unbounded long-form tag IDs ", " - debian/patches/CVE-2026-59886.patch: Merge commit from fork in", " pyasn1/type/univ.py, tests/codec/ber/test_decoder.py,", " tests/codec/cer/test_decoder.py, tests/codec/der/test_decoder.py,", " tests/type/test_univ.py.", " - CVE-2026-59886", " * SECURITY UPDATE: Quadratic complexity in OBJECT IDENTIFIER and", " RELATIVE-OID processing allows denial of service", " - debian/patches/CVE-2026-59884.patch: Merge commit from fork in", " pyasn1/codec/ber/decoder.py, pyasn1/type/tag.py,", " tests/codec/ber/test_decoder.py, tests/codec/cer/test_decoder.py,", " tests/codec/der/test_decoder.py, tests/type/test_tag.py.", " - CVE-2026-59884", " * SECURITY UPDATE: Uncontrolled resource consumption when converting", " decoded REAL values", " - debian/patches/CVE-2026-59885.patch: Merge commit from fork in", " pyasn1/codec/ber/decoder.py, pyasn1/codec/ber/encoder.py,", " tests/codec/ber/test_decoder.py, tests/codec/ber/test_encoder.py.", " - CVE-2026-59885", "" ], "package": "pyasn1", "version": "0.4.8-4ubuntu0.3", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 20 Aug 2026 13:36:50 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.12", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.17", "version": "3.12.3-1ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.17", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:26 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.12-minimal", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.17", "version": "3.12.3-1ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.17", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:26 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-release-upgrader-core", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:24.04.28", "version": "1:24.04.28" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:24.04.29", "version": "1:24.04.29" }, "cves": [], "launchpad_bugs_fixed": [ 2078579, 2166415 ], "changes": [ { "cves": [], "log": [ "", " * Install dependencies of t64 packages (LP: #2078579)", " * Run pre-build.sh: updating mirrors (and .po offsets) for point release.", " (LP: #2166415)", "" ], "package": "ubuntu-release-upgrader", "version": "1:24.04.29", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2078579, 2166415 ], "author": "Julian Andres Klode ", "date": "Thu, 03 Sep 2026 23:11:07 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "udisks2", "from_version": { "source_package_name": "udisks2", "source_package_version": "2.10.1-6ubuntu1.3", "version": "2.10.1-6ubuntu1.3" }, "to_version": { "source_package_name": "udisks2", "source_package_version": "2.10.1-6ubuntu1.5", "version": "2.10.1-6ubuntu1.5" }, "cves": [ { "cve": "CVE-2026-7867", "url": "https://ubuntu.com/security/CVE-2026-7867", "cve_description": "A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.", "cve_priority": "medium", "cve_public_date": "2026-08-06 22:18:00 UTC" } ], "launchpad_bugs_fixed": [ 2156438 ], "changes": [ { "cves": [ { "cve": "CVE-2026-7867", "url": "https://ubuntu.com/security/CVE-2026-7867", "cve_description": "A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.", "cve_priority": "medium", "cve_public_date": "2026-08-06 22:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Privilege escalation via mount point injection", " - debian/patches/CVE-2026-7867-1.patch: udiskslinuxfilesystem: Separate real", " caller identity from as-user target in src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-2.patch: udiskslinuxfilesystem: Rework fstab", " mount authorization for as-user in data/org.freedesktop.UDisks2.xml,", " src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-3.patch: udiskslinuxfilesystem: Log real", " caller uid for as-user mounts in src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-4.patch: udisksdaemonutil: Pass as-user", " target to polkit details in src/udisksdaemonutil.c.", " - debian/patches/CVE-2026-7867-5.patch: tests: Add security tests for as-", " user mount authorization in src/tests/dbus-tests/test_80_filesystem.py.", " - CVE-2026-7867", "" ], "package": "udisks2", "version": "2.10.1-6ubuntu1.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 17 Aug 2026 10:49:58 -0400" }, { "cves": [], "log": [ "", " * d/t/upstream-system: install linux-modules-extra as this package provides", " the scsi_debug kernel module needed for the udisks2 tests.", " (LP: #2156438)", "" ], "package": "udisks2", "version": "2.10.1-6ubuntu1.4", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2156438 ], "author": "Hector Cao ", "date": "Wed, 01 Jul 2026 08:33:59 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "util-linux", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "uuid-runtime", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "wireless-regdb", "from_version": { "source_package_name": "wireless-regdb", "source_package_version": "2026.02.04-0ubuntu1~24.04.1", "version": "2026.02.04-0ubuntu1~24.04.1" }, "to_version": { "source_package_name": "wireless-regdb", "source_package_version": "2026.05.30-0ubuntu1~24.04.1", "version": "2026.05.30-0ubuntu1~24.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2163172, 2163172 ], "changes": [ { "cves": [], "log": [ "", " * Backport 2026.05.30-0ubuntu1 to Noble (LP: #2163172)", "" ], "package": "wireless-regdb", "version": "2026.05.30-0ubuntu1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2163172 ], "author": "Jacob Martin ", "date": "Mon, 17 Aug 2026 12:38:10 -0500" }, { "cves": [], "log": [ "", " * New upstream version 2026.05.30 (LP: #2163172)", " - debian/control: Exchange python3-m2crypto build dependency for", " python3-cryptography", "" ], "package": "wireless-regdb", "version": "2026.05.30-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2163172 ], "author": "Jacob Martin ", "date": "Mon, 10 Aug 2026 10:02:11 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "zlib1g:riscv64", "from_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg-3.1ubuntu2.1", "version": "1:1.3.dfsg-3.1ubuntu2.1" }, "to_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg-3.1ubuntu2.2", "version": "1:1.3.dfsg-3.1ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-27171", "url": "https://ubuntu.com/security/CVE-2026-27171", "cve_description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "cve_priority": "low", "cve_public_date": "2026-02-18 04:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-27171", "url": "https://ubuntu.com/security/CVE-2026-27171", "cve_description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "cve_priority": "low", "cve_public_date": "2026-02-18 04:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: resource consumption via infinite loop", " - debian/patches/CVE-2026-27171.patch: add negative length checks to", " crc32_combine64 and crc32_combine_gen64 functions in crc32.c", " - CVE-2026-27171", "" ], "package": "zlib", "version": "1:1.3.dfsg-3.1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Tue, 25 Aug 2026 13:41:30 +0300" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-headers-7.0.0-31-generic", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": null }, "to_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-31.31.1~24.04.1", "version": "7.0.0-31.31.1~24.04.1" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013, 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-31.31.1~24.04.1 -proposed tracker (LP: #2162409)", "", " [ Ubuntu-riscv: 7.0.0-31.31.1 ]", "", " * resolute/linux-riscv: 7.0.0-31.31.1 -proposed tracker (LP: #2162410)", " [ Ubuntu: 7.0.0-31.31 ]", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Sarah Emery ", "date": "Mon, 24 Aug 2026 10:38:48 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-30.30.1~24.04.1 -proposed tracker (LP: #2162180)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian.riscv-7.0/dkms-versions -- update from kernel-", " versions (main/s2026.07.06)", "", " [ Ubuntu-riscv: 7.0.0-30.30.1 ]", "", " * resolute/linux-riscv: 7.0.0-30.30.1 -proposed tracker (LP: #2162181)", " [ Ubuntu: 7.0.0-30.30 ]", " * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " [ Ubuntu-riscv: 7.0.0-29.29.1 ]", "", " * resolute/linux-riscv: 7.0.0-29.29.1 -proposed tracker (LP: #2160778)", " [ Ubuntu: 7.0.0-29.29 ]", " * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-30.30.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "author": "Sarah Emery ", "date": "Fri, 21 Aug 2026 15:18:50 +0200" } ], "notes": "linux-headers-7.0.0-31-generic version '7.0.0-31.31.1~24.04.1' (source package linux-riscv-7.0 version '7.0.0-31.31.1~24.04.1') was added. linux-headers-7.0.0-31-generic version '7.0.0-31.31.1~24.04.1' has the same source package name, linux-riscv-7.0, as removed package linux-headers-7.0.0-28-generic. As such we can use the source package version of the removed package, '7.0.0-28.28.1~24.04.3', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-image-7.0.0-31-generic", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": null }, "to_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-31.31.1~24.04.1", "version": "7.0.0-31.31.1~24.04.1" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013, 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-31.31.1~24.04.1 -proposed tracker (LP: #2162409)", "", " [ Ubuntu-riscv: 7.0.0-31.31.1 ]", "", " * resolute/linux-riscv: 7.0.0-31.31.1 -proposed tracker (LP: #2162410)", " [ Ubuntu: 7.0.0-31.31 ]", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Sarah Emery ", "date": "Mon, 24 Aug 2026 10:38:48 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-30.30.1~24.04.1 -proposed tracker (LP: #2162180)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian.riscv-7.0/dkms-versions -- update from kernel-", " versions (main/s2026.07.06)", "", " [ Ubuntu-riscv: 7.0.0-30.30.1 ]", "", " * resolute/linux-riscv: 7.0.0-30.30.1 -proposed tracker (LP: #2162181)", " [ Ubuntu: 7.0.0-30.30 ]", " * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " [ Ubuntu-riscv: 7.0.0-29.29.1 ]", "", " * resolute/linux-riscv: 7.0.0-29.29.1 -proposed tracker (LP: #2160778)", " [ Ubuntu: 7.0.0-29.29 ]", " * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-30.30.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "author": "Sarah Emery ", "date": "Fri, 21 Aug 2026 15:18:50 +0200" } ], "notes": "linux-image-7.0.0-31-generic version '7.0.0-31.31.1~24.04.1' (source package linux-riscv-7.0 version '7.0.0-31.31.1~24.04.1') was added. linux-image-7.0.0-31-generic version '7.0.0-31.31.1~24.04.1' has the same source package name, linux-riscv-7.0, as removed package linux-headers-7.0.0-28-generic. As such we can use the source package version of the removed package, '7.0.0-28.28.1~24.04.3', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-31-generic", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": null }, "to_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-31.31.1~24.04.1", "version": "7.0.0-31.31.1~24.04.1" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013, 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-31.31.1~24.04.1 -proposed tracker (LP: #2162409)", "", " [ Ubuntu-riscv: 7.0.0-31.31.1 ]", "", " * resolute/linux-riscv: 7.0.0-31.31.1 -proposed tracker (LP: #2162410)", " [ Ubuntu: 7.0.0-31.31 ]", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Sarah Emery ", "date": "Mon, 24 Aug 2026 10:38:48 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-30.30.1~24.04.1 -proposed tracker (LP: #2162180)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian.riscv-7.0/dkms-versions -- update from kernel-", " versions (main/s2026.07.06)", "", " [ Ubuntu-riscv: 7.0.0-30.30.1 ]", "", " * resolute/linux-riscv: 7.0.0-30.30.1 -proposed tracker (LP: #2162181)", " [ Ubuntu: 7.0.0-30.30 ]", " * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " [ Ubuntu-riscv: 7.0.0-29.29.1 ]", "", " * resolute/linux-riscv: 7.0.0-29.29.1 -proposed tracker (LP: #2160778)", " [ Ubuntu: 7.0.0-29.29 ]", " * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-30.30.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "author": "Sarah Emery ", "date": "Fri, 21 Aug 2026 15:18:50 +0200" } ], "notes": "linux-modules-7.0.0-31-generic version '7.0.0-31.31.1~24.04.1' (source package linux-riscv-7.0 version '7.0.0-31.31.1~24.04.1') was added. linux-modules-7.0.0-31-generic version '7.0.0-31.31.1~24.04.1' has the same source package name, linux-riscv-7.0, as removed package linux-headers-7.0.0-28-generic. As such we can use the source package version of the removed package, '7.0.0-28.28.1~24.04.3', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-riscv-7.0-headers-7.0.0-31", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": null }, "to_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-31.31.1~24.04.1", "version": "7.0.0-31.31.1~24.04.1" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013, 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-31.31.1~24.04.1 -proposed tracker (LP: #2162409)", "", " [ Ubuntu-riscv: 7.0.0-31.31.1 ]", "", " * resolute/linux-riscv: 7.0.0-31.31.1 -proposed tracker (LP: #2162410)", " [ Ubuntu: 7.0.0-31.31 ]", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Sarah Emery ", "date": "Mon, 24 Aug 2026 10:38:48 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-30.30.1~24.04.1 -proposed tracker (LP: #2162180)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian.riscv-7.0/dkms-versions -- update from kernel-", " versions (main/s2026.07.06)", "", " [ Ubuntu-riscv: 7.0.0-30.30.1 ]", "", " * resolute/linux-riscv: 7.0.0-30.30.1 -proposed tracker (LP: #2162181)", " [ Ubuntu: 7.0.0-30.30 ]", " * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " [ Ubuntu-riscv: 7.0.0-29.29.1 ]", "", " * resolute/linux-riscv: 7.0.0-29.29.1 -proposed tracker (LP: #2160778)", " [ Ubuntu: 7.0.0-29.29 ]", " * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-30.30.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "author": "Sarah Emery ", "date": "Fri, 21 Aug 2026 15:18:50 +0200" } ], "notes": "linux-riscv-7.0-headers-7.0.0-31 version '7.0.0-31.31.1~24.04.1' (source package linux-riscv-7.0 version '7.0.0-31.31.1~24.04.1') was added. linux-riscv-7.0-headers-7.0.0-31 version '7.0.0-31.31.1~24.04.1' has the same source package name, linux-riscv-7.0, as removed package linux-headers-7.0.0-28-generic. As such we can use the source package version of the removed package, '7.0.0-28.28.1~24.04.3', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-riscv-7.0-tools-7.0.0-31", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": null }, "to_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-31.31.1~24.04.1", "version": "7.0.0-31.31.1~24.04.1" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013, 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-31.31.1~24.04.1 -proposed tracker (LP: #2162409)", "", " [ Ubuntu-riscv: 7.0.0-31.31.1 ]", "", " * resolute/linux-riscv: 7.0.0-31.31.1 -proposed tracker (LP: #2162410)", " [ Ubuntu: 7.0.0-31.31 ]", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Sarah Emery ", "date": "Mon, 24 Aug 2026 10:38:48 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-30.30.1~24.04.1 -proposed tracker (LP: #2162180)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian.riscv-7.0/dkms-versions -- update from kernel-", " versions (main/s2026.07.06)", "", " [ Ubuntu-riscv: 7.0.0-30.30.1 ]", "", " * resolute/linux-riscv: 7.0.0-30.30.1 -proposed tracker (LP: #2162181)", " [ Ubuntu: 7.0.0-30.30 ]", " * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " [ Ubuntu-riscv: 7.0.0-29.29.1 ]", "", " * resolute/linux-riscv: 7.0.0-29.29.1 -proposed tracker (LP: #2160778)", " [ Ubuntu: 7.0.0-29.29 ]", " * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-30.30.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "author": "Sarah Emery ", "date": "Fri, 21 Aug 2026 15:18:50 +0200" } ], "notes": "linux-riscv-7.0-tools-7.0.0-31 version '7.0.0-31.31.1~24.04.1' (source package linux-riscv-7.0 version '7.0.0-31.31.1~24.04.1') was added. linux-riscv-7.0-tools-7.0.0-31 version '7.0.0-31.31.1~24.04.1' has the same source package name, linux-riscv-7.0, as removed package linux-headers-7.0.0-28-generic. As such we can use the source package version of the removed package, '7.0.0-28.28.1~24.04.3', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-7.0.0-31-generic", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": null }, "to_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-31.31.1~24.04.1", "version": "7.0.0-31.31.1~24.04.1" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013, 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-31.31.1~24.04.1 -proposed tracker (LP: #2162409)", "", " [ Ubuntu-riscv: 7.0.0-31.31.1 ]", "", " * resolute/linux-riscv: 7.0.0-31.31.1 -proposed tracker (LP: #2162410)", " [ Ubuntu: 7.0.0-31.31 ]", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-31.31.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162409, 2162410, 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Sarah Emery ", "date": "Mon, 24 Aug 2026 10:38:48 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux-riscv-7.0: 7.0.0-30.30.1~24.04.1 -proposed tracker (LP: #2162180)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian.riscv-7.0/dkms-versions -- update from kernel-", " versions (main/s2026.07.06)", "", " [ Ubuntu-riscv: 7.0.0-30.30.1 ]", "", " * resolute/linux-riscv: 7.0.0-30.30.1 -proposed tracker (LP: #2162181)", " [ Ubuntu: 7.0.0-30.30 ]", " * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " [ Ubuntu-riscv: 7.0.0-29.29.1 ]", "", " * resolute/linux-riscv: 7.0.0-29.29.1 -proposed tracker (LP: #2160778)", " [ Ubuntu: 7.0.0-29.29 ]", " * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", " * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "" ], "package": "linux-riscv-7.0", "version": "7.0.0-30.30.1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162180, 1786013, 2162181, 2162185, 2160778, 2160781, 1786013, 2158267 ], "author": "Sarah Emery ", "date": "Fri, 21 Aug 2026 15:18:50 +0200" } ], "notes": "linux-tools-7.0.0-31-generic version '7.0.0-31.31.1~24.04.1' (source package linux-riscv-7.0 version '7.0.0-31.31.1~24.04.1') was added. linux-tools-7.0.0-31-generic version '7.0.0-31.31.1~24.04.1' has the same source package name, linux-riscv-7.0, as removed package linux-headers-7.0.0-28-generic. As such we can use the source package version of the removed package, '7.0.0-28.28.1~24.04.3', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-headers-7.0.0-28-generic", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": "7.0.0-28.28.1~24.04.3" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-7.0.0-28-generic", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": "7.0.0-28.28.1~24.04.3" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-28-generic", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": "7.0.0-28.28.1~24.04.3" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-riscv-7.0-headers-7.0.0-28", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": "7.0.0-28.28.1~24.04.3" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-riscv-7.0-tools-7.0.0-28", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": "7.0.0-28.28.1~24.04.3" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-7.0.0-28-generic", "from_version": { "source_package_name": "linux-riscv-7.0", "source_package_version": "7.0.0-28.28.1~24.04.3", "version": "7.0.0-28.28.1~24.04.3" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 24.04 noble image from daily image serial 20260826 to 20260911", "from_series": "noble", "to_series": "noble", "from_serial": "20260826", "to_serial": "20260911", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }