{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-headers-7.0.0-31", "linux-headers-7.0.0-31-generic", "linux-image-7.0.0-31-generic", "linux-modules-7.0.0-31-generic", "linux-tools-7.0.0-31", "linux-tools-7.0.0-31-generic" ], "removed": [ "linux-headers-7.0.0-30", "linux-headers-7.0.0-30-generic", "linux-image-7.0.0-30-generic", "linux-modules-7.0.0-30-generic", "linux-tools-7.0.0-30", "linux-tools-7.0.0-30-generic" ], "diff": [ "base-files", "bind9-dnsutils", "bind9-host", "bind9-libs:armhf", "bpftool", "bsdextrautils", "bsdutils", "cpio", "curl", "diffutils", "dirmngr", "dmidecode", "dracut", "dracut-core", "dracut-install", "dracut-network", "eject", "fdisk", "gnu-coreutils", "gnupg", "gnupg-l10n", "gnupg-utils", "gpg", "gpg-agent", "gpg-wks-client", "gpgconf", "gpgsm", "gpgv", "libattr1:armhf", "libaudit-common", "libaudit1:armhf", "libblkid1:armhf", "libbz2-1.0:armhf", "libc-bin", "libc-dev-bin", "libc-gconv-modules-extra:armhf", "libc6:armhf", "libc6-dev:armhf", "libcurl3t64-gnutls:armhf", "libcurl4t64:armhf", "libevent-core-2.1-7t64:armhf", "libfdisk1:armhf", "libflashrom1:armhf", "libgcrypt20:armhf", "liblastlog2-2:armhf", "libmount1:armhf", "libnetplan1:armhf", "libpam-modules:armhf", "libpam-modules-bin", "libpam-runtime", "libpam0g:armhf", "libperl5.40:armhf", "libpolkit-agent-1-0:armhf", "libpolkit-gobject-1-0:armhf", "libpython3.14:armhf", "libpython3.14-minimal:armhf", "libpython3.14-stdlib:armhf", "libsmartcols1:armhf", "libsqlite3-0:armhf", "libssh2-1t64:armhf", "libssl3t64:armhf", "libudisks2-0:armhf", "libuuid1:armhf", "linux-headers-generic", "linux-headers-virtual", "linux-image-virtual", "linux-libc-dev:armhf", "linux-tools-common", "linux-virtual", "locales", "login", "mdadm", "motd-news-config", "mount", "netplan-generator", "netplan.io", "openssh-client", "openssh-server", "openssh-sftp-server", "openssl", "openssl-provider-legacy", "perl", "perl-base", "perl-modules-5.40", "polkitd", "python-apt-common", "python3-apt", "python3-cryptography", "python3-distupgrade", "python3-netplan", "python3-pyasn1", "python3.14", "python3.14-gdbm", "python3.14-minimal", "sos", "sudo-rs", "ubuntu-release-upgrader-core", "udisks2", "util-linux", "util-linux-extra", "uuid-runtime", "vim", "vim-common", "vim-runtime", "vim-tiny", "wireless-regdb", "xxd", "zlib1g:armhf" ] } }, "diff": { "deb": [ { "name": "base-files", "from_version": { "source_package_name": "base-files", "source_package_version": "14ubuntu6.1", "version": "14ubuntu6.1" }, "to_version": { "source_package_name": "base-files", "source_package_version": "14ubuntu6.2", "version": "14ubuntu6.2" }, "cves": [], "launchpad_bugs_fixed": [ 2164885 ], "changes": [ { "cves": [], "log": [ "", " * /etc/issue{,.net}, /etc/{lsb,os}-release: bump version to 26.04.1", " (LP: #2164885)", "" ], "package": "base-files", "version": "14ubuntu6.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2164885 ], "author": "Oliver Reiche ", "date": "Mon, 24 Aug 2026 12:33:48 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-dnsutils", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu0.2", "version": "1:9.20.24-1ubuntu0.2" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu0.3", "version": "1:9.20.24-1ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3", " both present", " - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could", " find unsigned NSEC/NSEC3 in lib/dns/qpcache.c, lib/dns/rbtdb.c,", " lib/dns/rdatalist.c, lib/dns/resolver.c, lib/ns/query.c.", " - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname", " mismatch in", " bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,", " bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,", " bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests", " /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_", " runtime_check.py.", " - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,", " bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/", " system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-13204", "" ], "package": "bind9", "version": "1:9.20.24-1ubuntu0.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 27 Aug 2026 10:09:09 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-host", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu0.2", "version": "1:9.20.24-1ubuntu0.2" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu0.3", "version": "1:9.20.24-1ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3", " both present", " - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could", " find unsigned NSEC/NSEC3 in lib/dns/qpcache.c, lib/dns/rbtdb.c,", " lib/dns/rdatalist.c, lib/dns/resolver.c, lib/ns/query.c.", " - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname", " mismatch in", " bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,", " bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,", " bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests", " /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_", " runtime_check.py.", " - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,", " bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/", " system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-13204", "" ], "package": "bind9", "version": "1:9.20.24-1ubuntu0.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 27 Aug 2026 10:09:09 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-libs:armhf", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu0.2", "version": "1:9.20.24-1ubuntu0.2" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu0.3", "version": "1:9.20.24-1ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3", " both present", " - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could", " find unsigned NSEC/NSEC3 in lib/dns/qpcache.c, lib/dns/rbtdb.c,", " lib/dns/rdatalist.c, lib/dns/resolver.c, lib/ns/query.c.", " - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname", " mismatch in", " bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,", " bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,", " bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests", " /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_", " runtime_check.py.", " - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,", " bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/", " system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-13204", "" ], "package": "bind9", "version": "1:9.20.24-1ubuntu0.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 27 Aug 2026 10:09:09 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bpftool", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.7.0+7.0.0-30.30" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-31.31", "version": "7.7.0+7.0.0-31.31" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", "", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", "", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", "", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", "", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", "", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", "", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", "", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", "", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", "", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", "", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", "", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", "", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", "", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", "", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:09:29 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "bsdextrautils", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bsdutils", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "1:2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "1:2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "cpio", "from_version": { "source_package_name": "cpio", "source_package_version": "2.15+dfsg-2.1", "version": "2.15+dfsg-2.1" }, "to_version": { "source_package_name": "cpio", "source_package_version": "2.15+dfsg-2.1ubuntu0.1", "version": "2.15+dfsg-2.1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-66485", "url": "https://ubuntu.com/security/CVE-2026-66485", "cve_description": "GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66484", "url": "https://ubuntu.com/security/CVE-2026-66484", "cve_description": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66486", "url": "https://ubuntu.com/security/CVE-2026-66486", "cve_description": "GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2019-14866", "url": "https://ubuntu.com/security/CVE-2019-14866", "cve_description": "In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.", "cve_priority": "medium", "cve_public_date": "2020-01-07 17:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-66485", "url": "https://ubuntu.com/security/CVE-2026-66485", "cve_description": "GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66484", "url": "https://ubuntu.com/security/CVE-2026-66484", "cve_description": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66486", "url": "https://ubuntu.com/security/CVE-2026-66486", "cve_description": "GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2019-14866", "url": "https://ubuntu.com/security/CVE-2019-14866", "cve_description": "In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.", "cve_priority": "medium", "cve_public_date": "2020-01-07 17:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unbounded stack allocation", " - debian/patches/CVE-2026-66485.patch: Minor fixes in src/makepath.c,", " src/userspec.c.", " - CVE-2026-66485", " * SECURITY UPDATE: Hard link to file outside intended directory", " - debian/patches/CVE-2026-66484.patch: The --no-absolute-filenames option", " affects hard link targets too. in src/tar.c.", " - CVE-2026-66484", " * SECURITY UPDATE: Unescaped output", " - debian/patches/CVE-2026-66486.patch: Quote file names in error messages", " and in listings. in src/copyin.c, src/copyout.c, src/copypass.c,", " src/main.c, tests/CVE-2019-14866.at.", " - CVE-2026-66486", "" ], "package": "cpio", "version": "2.15+dfsg-2.1ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Isabel Garcia Contreras ", "date": "Mon, 17 Aug 2026 16:31:23 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.4", "version": "8.18.0-1ubuntu2.4" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.5", "version": "8.18.0-1ubuntu2.5" }, "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass in connection reuse.", " - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in", " lib/ldap.c, ../urldata.h, lib/vssh/libssh.c, ../libssh2.c,", " lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../rustls.c,", " ../schannel.c, ../vtls.c, ../vtls_scache.c, ../vtls_scache.h,", " and ../wolfssl.c.", " - CVE-2026-8932", "" ], "package": "curl", "version": "8.18.0-1ubuntu2.5", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Fri, 21 Aug 2026 12:55:56 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "diffutils", "from_version": { "source_package_name": "diffutils", "source_package_version": "1:3.12-1", "version": "1:3.12-1" }, "to_version": { "source_package_name": "diffutils", "source_package_version": "1:3.12-1ubuntu0.1", "version": "1:3.12-1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Integer Overflow", " - debian/patches/CVE-2026-53910-1.patch: diff3: check for integer overflows", " when reading line numbers from diff in NEWS, THANKS, src/diff3.c.", " - debian/patches/CVE-2026-53910-2.patch: diff3: prevent overflow in line", " offsets in src/diff3.c.", " - CVE-2026-53910", "" ], "package": "diffutils", "version": "1:3.12-1ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 26 Aug 2026 14:14:58 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "dirmngr", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3.1", "version": "2.4.8-4ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.8-4ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "dmidecode", "from_version": { "source_package_name": "dmidecode", "source_package_version": "3.6-2build1", "version": "3.6-2build1" }, "to_version": { "source_package_name": "dmidecode", "source_package_version": "3.6-2ubuntu1", "version": "3.6-2ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148318 ], "changes": [ { "cves": [], "log": [ "", " * Display slot ID for more slot types and EDSFF (LP: #2148318)", " - d/p/lp-2148318-1-dmidecode-Display-slot-information-for-EDSFF.patch", " - d/p/lp-2148318-2-dmidecode-Display-the-slot-ID-for-more-slot-types.patch", "" ], "package": "dmidecode", "version": "3.6-2ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148318 ], "author": "Mitchell Augustin ", "date": "Thu, 02 Jul 2026 11:51:52 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "dracut", "from_version": { "source_package_name": "dracut", "source_package_version": "110-11", "version": "110-11" }, "to_version": { "source_package_name": "dracut", "source_package_version": "110-11ubuntu0.1", "version": "110-11ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15816", "url": "https://ubuntu.com/security/CVE-2026-15816", "cve_description": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.", "cve_priority": "medium", "cve_public_date": "2026-08-07 11:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15816", "url": "https://ubuntu.com/security/CVE-2026-15816", "cve_description": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.", "cve_priority": "medium", "cve_public_date": "2026-08-07 11:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Several security issues", " - debian/patches/fix-base-sanitize-message-written-by-die-to-the-emergency.patch:", " sanitize message written by die() to the emergency hook at", " modules.d/80base/dracut-lib.sh", " - CVE-2026-15816", " - debian/patches/fix-overlayfs-crypt-prevent-eval-injection-in-parse_overl.patch:", " prevent eval injection in parse_overlay_opts() at", " modules.d/71overlayfs-crypt/overlayfs-crypt-lib.sh", " - No CVE number", " - debian/patches/feat-base-add-escape-function-implementing-printf-q.patch:", " add escape function implementing printf %q at", " modules.d/80base/dracut-lib.sh", " - No CVE number", " - debian/patches/fix-dracut-lib-sanitize-variable-assignments-using-eval.patch:", " sanitize variable assignments using eval at", " modules.d/80base/dracut-lib.sh", " - No CVE number", " - debian/patches/fix-systemd-networkd-escape-values-from-DHCP-options.patch:", " escape values from DHCP options at", " modules.d/11systemd-networkd/networkd-run.sh", " - No CVE number", " - debian/patches/fix-iscsi-normalize-initiator-and-target-names.patch:", " normalize initiator and target names at", " modules.d/45net-lib/net-lib.sh, modules.d/74iscsi/iscsiroot.sh,", " modules.d/74iscsi/module-setup.sh, modules.d/74iscsi/parse-iscsiroot.sh", " - No CVE number", " - debian/patches/fix-net-lib-validate-iSCSI-LUN-parameters.patch:", " validate iSCSI LUN parameters at modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-net-lib-normalize-iSCSI-target-names-on-the-iqn.-eui..patch:", " normalize iSCSI target names on the iqn./eui./naa. path at", " modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-iscsi-do-not-source-the-boot-time-net-lib.sh-into-mod.patch:", " do not source the boot-time net-lib.sh into module-setup.sh at", " dracut-functions.sh, modules.d/74iscsi/module-setup.sh", " - No CVE number", " - debian/patches/fix-iscsi-normalize-the-target-name-in-the-generated-netr.patch:", " normalize the target name in the generated netroot= line at", " modules.d/74iscsi/module-setup.sh", " - No CVE number", " - debian/patches/fix-dracut-remove-globbing-does-not-work.patch:", " --remove globbing does not work at dracut.sh", " - No CVE number", " - debian/patches/fix-dracut-remove-allows-removing-files-from-the-host-fil.patch:", " --remove allows removing files from the host filesystem at dracut.sh", " - No CVE number", " - debian/patches/refactor-net-lib-use-strip_non_digits-to-validate-iSCSI-L.patch:", " use strip_non_digits() to validate iSCSI LUN parameters at", " modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-net-lib-validate-iSCSI-port-parameters.patch:", " validate iSCSI port parameters at modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-iscsi-sanitize-netroot-value-passed-to-initqueue-scri.patch:", " sanitize netroot= value passed to initqueue scripts at", " modules.d/74iscsi/parse-iscsiroot.sh", " - No CVE number", " * Thanks Benjamin Drung for the fixes", "" ], "package": "dracut", "version": "110-11ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Wed, 09 Sep 2026 10:09:34 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "dracut-core", "from_version": { "source_package_name": "dracut", "source_package_version": "110-11", "version": "110-11" }, "to_version": { "source_package_name": "dracut", "source_package_version": "110-11ubuntu0.1", "version": "110-11ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15816", "url": "https://ubuntu.com/security/CVE-2026-15816", "cve_description": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.", "cve_priority": "medium", "cve_public_date": "2026-08-07 11:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15816", "url": "https://ubuntu.com/security/CVE-2026-15816", "cve_description": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.", "cve_priority": "medium", "cve_public_date": "2026-08-07 11:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Several security issues", " - debian/patches/fix-base-sanitize-message-written-by-die-to-the-emergency.patch:", " sanitize message written by die() to the emergency hook at", " modules.d/80base/dracut-lib.sh", " - CVE-2026-15816", " - debian/patches/fix-overlayfs-crypt-prevent-eval-injection-in-parse_overl.patch:", " prevent eval injection in parse_overlay_opts() at", " modules.d/71overlayfs-crypt/overlayfs-crypt-lib.sh", " - No CVE number", " - debian/patches/feat-base-add-escape-function-implementing-printf-q.patch:", " add escape function implementing printf %q at", " modules.d/80base/dracut-lib.sh", " - No CVE number", " - debian/patches/fix-dracut-lib-sanitize-variable-assignments-using-eval.patch:", " sanitize variable assignments using eval at", " modules.d/80base/dracut-lib.sh", " - No CVE number", " - debian/patches/fix-systemd-networkd-escape-values-from-DHCP-options.patch:", " escape values from DHCP options at", " modules.d/11systemd-networkd/networkd-run.sh", " - No CVE number", " - debian/patches/fix-iscsi-normalize-initiator-and-target-names.patch:", " normalize initiator and target names at", " modules.d/45net-lib/net-lib.sh, modules.d/74iscsi/iscsiroot.sh,", " modules.d/74iscsi/module-setup.sh, modules.d/74iscsi/parse-iscsiroot.sh", " - No CVE number", " - debian/patches/fix-net-lib-validate-iSCSI-LUN-parameters.patch:", " validate iSCSI LUN parameters at modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-net-lib-normalize-iSCSI-target-names-on-the-iqn.-eui..patch:", " normalize iSCSI target names on the iqn./eui./naa. path at", " modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-iscsi-do-not-source-the-boot-time-net-lib.sh-into-mod.patch:", " do not source the boot-time net-lib.sh into module-setup.sh at", " dracut-functions.sh, modules.d/74iscsi/module-setup.sh", " - No CVE number", " - debian/patches/fix-iscsi-normalize-the-target-name-in-the-generated-netr.patch:", " normalize the target name in the generated netroot= line at", " modules.d/74iscsi/module-setup.sh", " - No CVE number", " - debian/patches/fix-dracut-remove-globbing-does-not-work.patch:", " --remove globbing does not work at dracut.sh", " - No CVE number", " - debian/patches/fix-dracut-remove-allows-removing-files-from-the-host-fil.patch:", " --remove allows removing files from the host filesystem at dracut.sh", " - No CVE number", " - debian/patches/refactor-net-lib-use-strip_non_digits-to-validate-iSCSI-L.patch:", " use strip_non_digits() to validate iSCSI LUN parameters at", " modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-net-lib-validate-iSCSI-port-parameters.patch:", " validate iSCSI port parameters at modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-iscsi-sanitize-netroot-value-passed-to-initqueue-scri.patch:", " sanitize netroot= value passed to initqueue scripts at", " modules.d/74iscsi/parse-iscsiroot.sh", " - No CVE number", " * Thanks Benjamin Drung for the fixes", "" ], "package": "dracut", "version": "110-11ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Wed, 09 Sep 2026 10:09:34 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "dracut-install", "from_version": { "source_package_name": "dracut", "source_package_version": "110-11", "version": "110-11" }, "to_version": { "source_package_name": "dracut", "source_package_version": "110-11ubuntu0.1", "version": "110-11ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15816", "url": "https://ubuntu.com/security/CVE-2026-15816", "cve_description": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.", "cve_priority": "medium", "cve_public_date": "2026-08-07 11:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15816", "url": "https://ubuntu.com/security/CVE-2026-15816", "cve_description": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.", "cve_priority": "medium", "cve_public_date": "2026-08-07 11:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Several security issues", " - debian/patches/fix-base-sanitize-message-written-by-die-to-the-emergency.patch:", " sanitize message written by die() to the emergency hook at", " modules.d/80base/dracut-lib.sh", " - CVE-2026-15816", " - debian/patches/fix-overlayfs-crypt-prevent-eval-injection-in-parse_overl.patch:", " prevent eval injection in parse_overlay_opts() at", " modules.d/71overlayfs-crypt/overlayfs-crypt-lib.sh", " - No CVE number", " - debian/patches/feat-base-add-escape-function-implementing-printf-q.patch:", " add escape function implementing printf %q at", " modules.d/80base/dracut-lib.sh", " - No CVE number", " - debian/patches/fix-dracut-lib-sanitize-variable-assignments-using-eval.patch:", " sanitize variable assignments using eval at", " modules.d/80base/dracut-lib.sh", " - No CVE number", " - debian/patches/fix-systemd-networkd-escape-values-from-DHCP-options.patch:", " escape values from DHCP options at", " modules.d/11systemd-networkd/networkd-run.sh", " - No CVE number", " - debian/patches/fix-iscsi-normalize-initiator-and-target-names.patch:", " normalize initiator and target names at", " modules.d/45net-lib/net-lib.sh, modules.d/74iscsi/iscsiroot.sh,", " modules.d/74iscsi/module-setup.sh, modules.d/74iscsi/parse-iscsiroot.sh", " - No CVE number", " - debian/patches/fix-net-lib-validate-iSCSI-LUN-parameters.patch:", " validate iSCSI LUN parameters at modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-net-lib-normalize-iSCSI-target-names-on-the-iqn.-eui..patch:", " normalize iSCSI target names on the iqn./eui./naa. path at", " modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-iscsi-do-not-source-the-boot-time-net-lib.sh-into-mod.patch:", " do not source the boot-time net-lib.sh into module-setup.sh at", " dracut-functions.sh, modules.d/74iscsi/module-setup.sh", " - No CVE number", " - debian/patches/fix-iscsi-normalize-the-target-name-in-the-generated-netr.patch:", " normalize the target name in the generated netroot= line at", " modules.d/74iscsi/module-setup.sh", " - No CVE number", " - debian/patches/fix-dracut-remove-globbing-does-not-work.patch:", " --remove globbing does not work at dracut.sh", " - No CVE number", " - debian/patches/fix-dracut-remove-allows-removing-files-from-the-host-fil.patch:", " --remove allows removing files from the host filesystem at dracut.sh", " - No CVE number", " - debian/patches/refactor-net-lib-use-strip_non_digits-to-validate-iSCSI-L.patch:", " use strip_non_digits() to validate iSCSI LUN parameters at", " modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-net-lib-validate-iSCSI-port-parameters.patch:", " validate iSCSI port parameters at modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-iscsi-sanitize-netroot-value-passed-to-initqueue-scri.patch:", " sanitize netroot= value passed to initqueue scripts at", " modules.d/74iscsi/parse-iscsiroot.sh", " - No CVE number", " * Thanks Benjamin Drung for the fixes", "" ], "package": "dracut", "version": "110-11ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Wed, 09 Sep 2026 10:09:34 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "dracut-network", "from_version": { "source_package_name": "dracut", "source_package_version": "110-11", "version": "110-11" }, "to_version": { "source_package_name": "dracut", "source_package_version": "110-11ubuntu0.1", "version": "110-11ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15816", "url": "https://ubuntu.com/security/CVE-2026-15816", "cve_description": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.", "cve_priority": "medium", "cve_public_date": "2026-08-07 11:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15816", "url": "https://ubuntu.com/security/CVE-2026-15816", "cve_description": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.", "cve_priority": "medium", "cve_public_date": "2026-08-07 11:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Several security issues", " - debian/patches/fix-base-sanitize-message-written-by-die-to-the-emergency.patch:", " sanitize message written by die() to the emergency hook at", " modules.d/80base/dracut-lib.sh", " - CVE-2026-15816", " - debian/patches/fix-overlayfs-crypt-prevent-eval-injection-in-parse_overl.patch:", " prevent eval injection in parse_overlay_opts() at", " modules.d/71overlayfs-crypt/overlayfs-crypt-lib.sh", " - No CVE number", " - debian/patches/feat-base-add-escape-function-implementing-printf-q.patch:", " add escape function implementing printf %q at", " modules.d/80base/dracut-lib.sh", " - No CVE number", " - debian/patches/fix-dracut-lib-sanitize-variable-assignments-using-eval.patch:", " sanitize variable assignments using eval at", " modules.d/80base/dracut-lib.sh", " - No CVE number", " - debian/patches/fix-systemd-networkd-escape-values-from-DHCP-options.patch:", " escape values from DHCP options at", " modules.d/11systemd-networkd/networkd-run.sh", " - No CVE number", " - debian/patches/fix-iscsi-normalize-initiator-and-target-names.patch:", " normalize initiator and target names at", " modules.d/45net-lib/net-lib.sh, modules.d/74iscsi/iscsiroot.sh,", " modules.d/74iscsi/module-setup.sh, modules.d/74iscsi/parse-iscsiroot.sh", " - No CVE number", " - debian/patches/fix-net-lib-validate-iSCSI-LUN-parameters.patch:", " validate iSCSI LUN parameters at modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-net-lib-normalize-iSCSI-target-names-on-the-iqn.-eui..patch:", " normalize iSCSI target names on the iqn./eui./naa. path at", " modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-iscsi-do-not-source-the-boot-time-net-lib.sh-into-mod.patch:", " do not source the boot-time net-lib.sh into module-setup.sh at", " dracut-functions.sh, modules.d/74iscsi/module-setup.sh", " - No CVE number", " - debian/patches/fix-iscsi-normalize-the-target-name-in-the-generated-netr.patch:", " normalize the target name in the generated netroot= line at", " modules.d/74iscsi/module-setup.sh", " - No CVE number", " - debian/patches/fix-dracut-remove-globbing-does-not-work.patch:", " --remove globbing does not work at dracut.sh", " - No CVE number", " - debian/patches/fix-dracut-remove-allows-removing-files-from-the-host-fil.patch:", " --remove allows removing files from the host filesystem at dracut.sh", " - No CVE number", " - debian/patches/refactor-net-lib-use-strip_non_digits-to-validate-iSCSI-L.patch:", " use strip_non_digits() to validate iSCSI LUN parameters at", " modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-net-lib-validate-iSCSI-port-parameters.patch:", " validate iSCSI port parameters at modules.d/45net-lib/net-lib.sh", " - No CVE number", " - debian/patches/fix-iscsi-sanitize-netroot-value-passed-to-initqueue-scri.patch:", " sanitize netroot= value passed to initqueue scripts at", " modules.d/74iscsi/parse-iscsiroot.sh", " - No CVE number", " * Thanks Benjamin Drung for the fixes", "" ], "package": "dracut", "version": "110-11ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Wed, 09 Sep 2026 10:09:34 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "eject", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "fdisk", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gnu-coreutils", "from_version": { "source_package_name": "coreutils", "source_package_version": "9.7-3ubuntu2", "version": "9.7-3ubuntu2" }, "to_version": { "source_package_name": "coreutils", "source_package_version": "9.7-3ubuntu2.1", "version": "9.7-3ubuntu2.1" }, "cves": [ { "cve": "CVE-2025-5278", "url": "https://ubuntu.com/security/CVE-2025-5278", "cve_description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "cve_priority": "low", "cve_public_date": "2025-05-27 21:15:00 UTC" }, { "cve": "CVE-2026-56391", "url": "https://ubuntu.com/security/CVE-2026-56391", "cve_description": "GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure. This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.", "cve_priority": "medium", "cve_public_date": "2026-07-24 09:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-5278", "url": "https://ubuntu.com/security/CVE-2025-5278", "cve_description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "cve_priority": "low", "cve_public_date": "2025-05-27 21:15:00 UTC" }, { "cve": "CVE-2026-56391", "url": "https://ubuntu.com/security/CVE-2026-56391", "cve_description": "GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure. This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.", "cve_priority": "medium", "cve_public_date": "2026-07-24 09:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: out-of-bounds read in sort", " - debian/patches/CVE-2025-5278.patch: sort: fix buffer under-read in", " src/sort.c, tests/local.mk, tests/sort/sort-field-limit.sh,", " Makefile.in.", " - CVE-2025-5278", " * SECURITY UPDATE: out‑of‑bounds read in uniq", " - debian/patches/CVE-2026-56391.patch: uniq: fix read overrun with -w in", " src/uniq.c, tests/uniq/uniq.pl.", " - CVE-2026-56391", "" ], "package": "coreutils", "version": "9.7-3ubuntu2.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 25 Aug 2026 11:07:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gnupg", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3.1", "version": "2.4.8-4ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.8-4ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gnupg-l10n", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3.1", "version": "2.4.8-4ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.8-4ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gnupg-utils", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3.1", "version": "2.4.8-4ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.8-4ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpg", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3.1", "version": "2.4.8-4ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.8-4ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpg-agent", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3.1", "version": "2.4.8-4ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.8-4ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpg-wks-client", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3.1", "version": "2.4.8-4ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.8-4ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgconf", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3.1", "version": "2.4.8-4ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.8-4ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgsm", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3.1", "version": "2.4.8-4ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.8-4ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgv", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3.1", "version": "2.4.8-4ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.8-4ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libattr1:armhf", "from_version": { "source_package_name": "attr", "source_package_version": "1:2.5.2-4", "version": "1:2.5.2-4" }, "to_version": { "source_package_name": "attr", "source_package_version": "1:2.5.2-4ubuntu0.1", "version": "1:2.5.2-4ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Symlink Traversal", " - d/p/upstream/CVE-2026-54371-01-add-visibility-attribute-header.patch: Add", " visibility attribute header in include/Makemodule.am, include/visibility-", " hidden.h.", " - d/p/upstream/CVE-2026-54371-02-add-xattrat-syscall-wrappers.patch: Add", " xattrat syscall wrappers in configure.ac, include/Makemodule.am,", " include/xattrat.h, libmisc/Makemodule.am, libmisc/xattrat.c.", " - d/p/upstream/CVE-2026-54371-03-add-xattrat-syscall-backwards-", " compatibility-code.patch: Add xattrat syscall backwards compatibility code", " in include/Makemodule.am, include/xattrat_compat.h, libmisc/Makemodule.am,", " libmisc/getxattrat_compat.c, libmisc/listxattrat_compat.c, libmisc/proc-", " self-fd.c, libmisc/proc-self-fd.h, libmisc/removexattrat_compat.c,", " libmisc/setxattrat_compat.c.", " - d/p/upstream/CVE-2026-54371-04-rename-walk_tree-to-old_walk_tree.patch:", " Rename walk_tree to old_walk_tree in include/Makemodule.am,", " include/old_walk_tree.h, libmisc/Makemodule.am, libmisc/old_walk_tree.c,", " tools/getfattr.c.", " - d/p/upstream/CVE-2026-54371-05-add-the-new-walk_tree-helper.patch: Add the", " new walk_tree helper in include/Makemodule.am, include/walk_tree.h,", " libmisc/Makemodule.am, libmisc/walk_tree.c.", " - debian/patches/upstream/CVE-2026-54371-06-harden-getfattr.patch: harden", " getfattr in man/man1/getfattr.1, tools/getfattr.c,", " test/root/getfattr.test.", " - d/p/upstream/CVE-2026-54371-07-setfattr-multiple-restore-accesses-freed-", " buffer.patch: setfattr: multiple --restore accesses freed buffer in", " tools/setfattr.c.", " - d/p/upstream/CVE-2026-54371-08-setfattr-do-not-ignore-no-dereference-", " after-restore.patch: setfattr: Do not ignore --no-dereference after", " --restore in tools/setfattr.c.", " - d/p/upstream/CVE-2026-54371-09-add-openat2-syscall-wrapper.patch: Add", " openat2 syscall wrapper in configure.ac, include/Makemodule.am,", " include/openat2.h, libmisc/Makemodule.am, libmisc/openat2.c.", " - d/p/upstream/CVE-2026-54371-10-harden-setfattr-restore.patch: harden", " setfattr --restore in configure.ac, man/man1/setfattr.1,", " test/Makemodule.am, tools/setfattr.c, test/restore.test.", " - CVE-2026-54371", "" ], "package": "attr", "version": "1:2.5.2-4ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Sun, 23 Aug 2026 21:34:50 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libaudit-common", "from_version": { "source_package_name": "audit", "source_package_version": "1:4.1.2-1build1", "version": "1:4.1.2-1build1" }, "to_version": { "source_package_name": "audit", "source_package_version": "1:4.1.2-1ubuntu0.1", "version": "1:4.1.2-1ubuntu0.1" }, "cves": [], "launchpad_bugs_fixed": [ 1117804 ], "changes": [ { "cves": [], "log": [ "", " * Fix AppArmor AVC events not appearing in `ausearch` (LP: #1117804)", " - d/p/lp1117804-audit-ausearch-do-not-require-tclass.patch", "" ], "package": "audit", "version": "1:4.1.2-1ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1117804 ], "author": "Alex Ramírez ", "date": "Mon, 13 Jul 2026 20:33:31 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libaudit1:armhf", "from_version": { "source_package_name": "audit", "source_package_version": "1:4.1.2-1build1", "version": "1:4.1.2-1build1" }, "to_version": { "source_package_name": "audit", "source_package_version": "1:4.1.2-1ubuntu0.1", "version": "1:4.1.2-1ubuntu0.1" }, "cves": [], "launchpad_bugs_fixed": [ 1117804 ], "changes": [ { "cves": [], "log": [ "", " * Fix AppArmor AVC events not appearing in `ausearch` (LP: #1117804)", " - d/p/lp1117804-audit-ausearch-do-not-require-tclass.patch", "" ], "package": "audit", "version": "1:4.1.2-1ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1117804 ], "author": "Alex Ramírez ", "date": "Mon, 13 Jul 2026 20:33:31 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblkid1:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbz2-1.0:armhf", "from_version": { "source_package_name": "bzip2", "source_package_version": "1.0.8-6build2", "version": "1.0.8-6build2" }, "to_version": { "source_package_name": "bzip2", "source_package_version": "1.0.8-6ubuntu0.1", "version": "1.0.8-6ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-42250", "url": "https://ubuntu.com/security/CVE-2026-42250", "cve_description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "cve_priority": "low", "cve_public_date": "2026-05-28 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42250", "url": "https://ubuntu.com/security/CVE-2026-42250", "cve_description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "cve_priority": "low", "cve_public_date": "2026-05-28 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: out-of-bounds write", " - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not", " process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.", " - CVE-2026-42250", "" ], "package": "bzip2", "version": "1.0.8-6ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shishir Subedi ", "date": "Thu, 27 Aug 2026 09:49:34 +0545" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.3", "version": "2.43-2ubuntu2.3" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.4", "version": "2.43-2ubuntu2.4" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.43-2ubuntu2.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:09:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-dev-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.3", "version": "2.43-2ubuntu2.3" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.4", "version": "2.43-2ubuntu2.4" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.43-2ubuntu2.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:09:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-gconv-modules-extra:armhf", "from_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.3", "version": "2.43-2ubuntu2.3" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.4", "version": "2.43-2ubuntu2.4" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.43-2ubuntu2.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:09:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6:armhf", "from_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.3", "version": "2.43-2ubuntu2.3" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.4", "version": "2.43-2ubuntu2.4" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.43-2ubuntu2.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:09:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6-dev:armhf", "from_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.3", "version": "2.43-2ubuntu2.3" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.4", "version": "2.43-2ubuntu2.4" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.43-2ubuntu2.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:09:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl3t64-gnutls:armhf", "from_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.4", "version": "8.18.0-1ubuntu2.4" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.5", "version": "8.18.0-1ubuntu2.5" }, "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass in connection reuse.", " - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in", " lib/ldap.c, ../urldata.h, lib/vssh/libssh.c, ../libssh2.c,", " lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../rustls.c,", " ../schannel.c, ../vtls.c, ../vtls_scache.c, ../vtls_scache.h,", " and ../wolfssl.c.", " - CVE-2026-8932", "" ], "package": "curl", "version": "8.18.0-1ubuntu2.5", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Fri, 21 Aug 2026 12:55:56 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4t64:armhf", "from_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.4", "version": "8.18.0-1ubuntu2.4" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.5", "version": "8.18.0-1ubuntu2.5" }, "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass in connection reuse.", " - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in", " lib/ldap.c, ../urldata.h, lib/vssh/libssh.c, ../libssh2.c,", " lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../rustls.c,", " ../schannel.c, ../vtls.c, ../vtls_scache.c, ../vtls_scache.h,", " and ../wolfssl.c.", " - CVE-2026-8932", "" ], "package": "curl", "version": "8.18.0-1ubuntu2.5", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Fri, 21 Aug 2026 12:55:56 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libevent-core-2.1-7t64:armhf", "from_version": { "source_package_name": "libevent", "source_package_version": "2.1.12-stable-10build2", "version": "2.1.12-stable-10build2" }, "to_version": { "source_package_name": "libevent", "source_package_version": "2.1.12-stable-10ubuntu0.1", "version": "2.1.12-stable-10ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-63381", "url": "https://ubuntu.com/security/CVE-2026-63381", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63382", "url": "https://ubuntu.com/security/CVE-2026-63382", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63383", "url": "https://ubuntu.com/security/CVE-2026-63383", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63384", "url": "https://ubuntu.com/security/CVE-2026-63384", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63385", "url": "https://ubuntu.com/security/CVE-2026-63385", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-63381", "url": "https://ubuntu.com/security/CVE-2026-63381", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63382", "url": "https://ubuntu.com/security/CVE-2026-63382", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63383", "url": "https://ubuntu.com/security/CVE-2026-63383", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63384", "url": "https://ubuntu.com/security/CVE-2026-63384", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63385", "url": "https://ubuntu.com/security/CVE-2026-63385", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: dangling pointer in buffer reference handling", " - debian/patches/CVE-2026-63381.patch: reset empty output buffer", " pointers and add regression coverage in buffer.c and", " test/regress_buffer.c.", " - CVE-2026-63381", " * SECURITY UPDATE: HTTP request smuggling in request body framing", " - debian/patches/CVE-2026-63382_1.patch: require strict CRLF chunk", " delimiters in http.c.", " - debian/patches/CVE-2026-63382_2.patch: validate transfer encodings", " and add tests in http-internal.h, http.c, and test/regress_http.c.", " - CVE-2026-63382", " * SECURITY UPDATE: out-of-bounds read during RPC tag decoding", " - debian/patches/CVE-2026-63383.patch: bound tag decoding to contiguous", " buffer data in event_tagging.c.", " - CVE-2026-63383", " * SECURITY UPDATE: integer overflow during RPC payload length decoding", " - debian/patches/CVE-2026-63384.patch: reject oversized RPC payload", " lengths in event_tagging.c and document the limit in", " include/event2/tag.h.", " - CVE-2026-63384", " * SECURITY UPDATE: HTTP header injection during folded header handling", " - debian/patches/CVE-2026-63385.patch: reject CR and LF in HTTP header", " values and update tests in http.c and test/regress_http.c.", " - CVE-2026-63385", "" ], "package": "libevent", "version": "2.1.12-stable-10ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Fri, 28 Aug 2026 16:44:21 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfdisk1:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libflashrom1:armhf", "from_version": { "source_package_name": "flashrom", "source_package_version": "1.6.0-2ubuntu1", "version": "1.6.0-2ubuntu1" }, "to_version": { "source_package_name": "flashrom", "source_package_version": "1.6.0-2ubuntu1.1", "version": "1.6.0-2ubuntu1.1" }, "cves": [], "launchpad_bugs_fixed": [ 2160030, 2160030 ], "changes": [ { "cves": [], "log": [ "", " * d/p: add support for additional Atmel/PUYA SPI flash chips,", " ported from the Raspberry Pi archive's flashrom package", " (LP: #2160030).", " * d/p: sfdp: sort erasers by block size, needed by the above", " (LP: #2160030).", "" ], "package": "flashrom", "version": "1.6.0-2ubuntu1.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2160030, 2160030 ], "author": "Dave Jones ", "date": "Wed, 15 Jul 2026 14:12:45 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgcrypt20:armhf", "from_version": { "source_package_name": "libgcrypt20", "source_package_version": "1.12.0-2ubuntu1", "version": "1.12.0-2ubuntu1" }, "to_version": { "source_package_name": "libgcrypt20", "source_package_version": "1.12.0-2ubuntu1.1", "version": "1.12.0-2ubuntu1.1" }, "cves": [ { "cve": "CVE-2024-2236", "url": "https://ubuntu.com/security/CVE-2024-2236", "cve_description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "cve_priority": "low", "cve_public_date": "2024-03-06 22:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2024-2236", "url": "https://ubuntu.com/security/CVE-2024-2236", "cve_description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "cve_priority": "low", "cve_public_date": "2024-03-06 22:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: timing-based side-channel flaw in RSA implementation", " - debian/patches/CVE-2024-2236-1.patch: rsa: Do not accept invalid PKCS#1.5", " padding when deciphering in cipher/rsa-common.c, src/const-time.h.", " - debian/patches/CVE-2024-2236-2.patch: rsa: Constant time blinding removal", " in cipher/rsa.c, configure.ac, mpi/Makefile.am, mpi/mpi-internal.h,", " mpi/mpi-mul-cs.c, mpi/mpi-mul.c, src/gcrypt-int.h.", " - debian/patches/CVE-2024-2236-3.patch: Constant time conversion of the", " message to the SEXP in cipher/rsa.c, src/const-time.c, src/const-time.h,", " src/sexp.c.", " - debian/patches/CVE-2024-2236-4.patch: rsa: Implement constant-time", " conversion of MPI to string in cipher/rsa-common.c.", " - debian/patches/CVE-2024-2236-5.patch: cipher: Use the constant time", " conversion also for OAEP in cipher/rsa-common.c, cipher/rsa.c.", " - debian/patches/CVE-2024-2236-6.patch: Implement implicit rejection for", " PKCS#1.5 decipher in cipher/pubkey-internal.h, cipher/pubkey-util.c,", " cipher/rsa-common.c, cipher/rsa.c, src/cipher.h, src/const-time.h,", " tests/pkcs1v2-v15c.h, tests/pkcs1v2.c.", " - debian/rules: build with --enable-marvin-workaround.", " - Thanks for Red Hat for the patches!", " - CVE-2024-2236", "" ], "package": "libgcrypt20", "version": "1.12.0-2ubuntu1.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 24 Aug 2026 13:54:07 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "liblastlog2-2:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libmount1:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnetplan1:armhf", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.2-1ubuntu5", "version": "1.2-1ubuntu5" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.2-1ubuntu5.1", "version": "1.2-1ubuntu5.1" }, "cves": [], "launchpad_bugs_fixed": [ 2104373 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2104373-return-exit-code-1-on-error.patch: return exit code 1 when", " netplan exits on error (LP: #2104373)", "" ], "package": "netplan.io", "version": "1.2-1ubuntu5.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2104373 ], "author": "Guilherme Puida Moreira ", "date": "Mon, 31 Aug 2026 09:23:48 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules:armhf", "from_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.1", "version": "1.7.0-5ubuntu3.1" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.2", "version": "1.7.0-5ubuntu3.2" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.7.0-5ubuntu3.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules-bin", "from_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.1", "version": "1.7.0-5ubuntu3.1" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.2", "version": "1.7.0-5ubuntu3.2" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.7.0-5ubuntu3.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-runtime", "from_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.1", "version": "1.7.0-5ubuntu3.1" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.2", "version": "1.7.0-5ubuntu3.2" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.7.0-5ubuntu3.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam0g:armhf", "from_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.1", "version": "1.7.0-5ubuntu3.1" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.2", "version": "1.7.0-5ubuntu3.2" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.7.0-5ubuntu3.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libperl5.40:armhf", "from_version": { "source_package_name": "perl", "source_package_version": "5.40.1-7ubuntu0.1", "version": "5.40.1-7ubuntu0.1" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.40.1-7ubuntu0.3", "version": "5.40.1-7ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", "" ], "package": "perl", "version": "5.40.1-7ubuntu0.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 08 Sep 2026 14:17:45 -0400" }, { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.40.1-7ubuntu0.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:10 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpolkit-agent-1-0:armhf", "from_version": { "source_package_name": "policykit-1", "source_package_version": "127-2ubuntu1", "version": "127-2ubuntu1" }, "to_version": { "source_package_name": "policykit-1", "source_package_version": "127-2ubuntu1.1", "version": "127-2ubuntu1.1" }, "cves": [ { "cve": "CVE-2026-85498", "url": "https://ubuntu.com/security/CVE-2026-85498", "cve_description": "[Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow]", "cve_priority": "medium", "cve_public_date": "2026-09-07" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-85498", "url": "https://ubuntu.com/security/CVE-2026-85498", "cve_description": "[Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow]", "cve_priority": "medium", "cve_public_date": "2026-09-07" } ], "log": [ "", " * SECURITY UPDATE: stack underflow in cookie input", " - debian/patches/CVE-2026-85498.patch: Unsanitized underflow in cookie", " input in src/polkitagent/polkitagenthelperprivate.c.", " - CVE-2026-85498", "" ], "package": "policykit-1", "version": "127-2ubuntu1.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 11 Sep 2026 13:30:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpolkit-gobject-1-0:armhf", "from_version": { "source_package_name": "policykit-1", "source_package_version": "127-2ubuntu1", "version": "127-2ubuntu1" }, "to_version": { "source_package_name": "policykit-1", "source_package_version": "127-2ubuntu1.1", "version": "127-2ubuntu1.1" }, "cves": [ { "cve": "CVE-2026-85498", "url": "https://ubuntu.com/security/CVE-2026-85498", "cve_description": "[Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow]", "cve_priority": "medium", "cve_public_date": "2026-09-07" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-85498", "url": "https://ubuntu.com/security/CVE-2026-85498", "cve_description": "[Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow]", "cve_priority": "medium", "cve_public_date": "2026-09-07" } ], "log": [ "", " * SECURITY UPDATE: stack underflow in cookie input", " - debian/patches/CVE-2026-85498.patch: Unsanitized underflow in cookie", " input in src/polkitagent/polkitagenthelperprivate.c.", " - CVE-2026-85498", "" ], "package": "policykit-1", "version": "127-2ubuntu1.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 11 Sep 2026 13:30:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.14:armhf", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.1", "version": "3.14.4-1ubuntu0.1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.2", "version": "3.14.4-1ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.14", "version": "3.14.4-1ubuntu0.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 20 Aug 2026 11:41:58 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.14-minimal:armhf", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.1", "version": "3.14.4-1ubuntu0.1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.2", "version": "3.14.4-1ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.14", "version": "3.14.4-1ubuntu0.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 20 Aug 2026 11:41:58 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.14-stdlib:armhf", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.1", "version": "3.14.4-1ubuntu0.1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.2", "version": "3.14.4-1ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.14", "version": "3.14.4-1ubuntu0.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 20 Aug 2026 11:41:58 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsmartcols1:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsqlite3-0:armhf", "from_version": { "source_package_name": "sqlite3", "source_package_version": "3.46.1-9ubuntu0.2", "version": "3.46.1-9ubuntu0.2" }, "to_version": { "source_package_name": "sqlite3", "source_package_version": "3.46.1-9ubuntu0.3", "version": "3.46.1-9ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-39113", "url": "https://ubuntu.com/security/CVE-2026-39113", "cve_description": "Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components", "cve_priority": "medium", "cve_public_date": "2026-08-25 21:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-39113", "url": "https://ubuntu.com/security/CVE-2026-39113", "cve_description": "Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components", "cve_priority": "medium", "cve_public_date": "2026-08-25 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: buffer overflow via integer truncation in sqlar extension", " - debian/patches/CVE-2026-39113.patch: change sqlite3_value_int() to", " sqlite3_value_int64() in sqlarUncompressFunc() in ext/misc/sqlar.c to", " prevent 32-bit truncation of the decompressed size, which caused an", " undersized buffer allocation and heap buffer overflow via uncompress().", " - CVE-2026-39113", "" ], "package": "sqlite3", "version": "3.46.1-9ubuntu0.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Thu, 03 Sep 2026 11:45:25 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssh2-1t64:armhf", "from_version": { "source_package_name": "libssh2", "source_package_version": "1.11.1-1ubuntu0.26.04.3", "version": "1.11.1-1ubuntu0.26.04.3" }, "to_version": { "source_package_name": "libssh2", "source_package_version": "1.11.1-1ubuntu0.26.04.4", "version": "1.11.1-1ubuntu0.26.04.4" }, "cves": [ { "cve": "CVE-2026-66032", "url": "https://ubuntu.com/security/CVE-2026-66032", "cve_description": "libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66033", "url": "https://ubuntu.com/security/CVE-2026-66033", "cve_description": "libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66035", "url": "https://ubuntu.com/security/CVE-2026-66035", "cve_description": "libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-66032", "url": "https://ubuntu.com/security/CVE-2026-66032", "cve_description": "libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66033", "url": "https://ubuntu.com/security/CVE-2026-66033", "cve_description": "libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66035", "url": "https://ubuntu.com/security/CVE-2026-66035", "cve_description": "libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: double-free vulnerability in sftp_open()", " - debian/patches/CVE-2026-66032.patch: Prevent dangling pointer by", " nullifying data in src/sftp.c.", " - CVE-2026-66032", " * SECURITY UPDATE: pre-authentication integer underflow vulnerability", " - debian/patches/CVE-2026-66033.patch: fix potential OOB read/write with", " AES-GCM in `ssh2_cipher_crypt()` in src/openssl.c.", " - CVE-2026-66033", " * SECURITY UPDATE: pre-authentication heap buffer overflow vulnerability", " - debian/patches/CVE-2026-66035.patch: transport: fix potential heap", " overflow on ETM decrypt in src/transport.c.", " - CVE-2026-66035", "" ], "package": "libssh2", "version": "1.11.1-1ubuntu0.26.04.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 02 Sep 2026 07:53:57 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssl3t64:armhf", "from_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.3", "version": "3.5.5-1ubuntu3.3" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.5", "version": "3.5.5-1ubuntu3.5" }, "cves": [ { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using", " EVP_Cipher()", " - debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()", " finalize: Poly1305 and OCB AEADs in", " providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c,", " providers/implementations/ciphers/cipher_aes_ocb.c,", " providers/implementations/ciphers/cipher_chacha20_poly1305.c.", " - debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD", " EVP_Cipher() finalization in test/evp_extra_test.c.", " - CVE-2026-75803", "" ], "package": "openssl", "version": "3.5.5-1ubuntu3.5", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 26 Aug 2026 07:58:23 -0400" }, { "cves": [ { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unbounded Memory Growth in QUIC Server Incoming Channel", " Queue", " - debian/patches/CVE-2026-14456.patch: QUIC server: limit number of pending", " QUIC channels/connections in doc/man3/SSL_get_value_uint.pod,", " include/internal/quic_port.h, include/openssl/ssl.h.in,", " ssl/quic/quic_impl.c, ssl/quic/quic_port.c, ssl/quic/quic_port_local.h,", " util/other.syms.", " - CVE-2026-14456", " * SECURITY UPDATE: RPK Server Signature Algorithm Selection Can Dereference", " a Missing Certificate", " - debian/patches/CVE-2026-14457.patch: Handle signature_algorithms_cert", " extension in key-only context in ssl/t1_lib.c, test/rpktest.c.", " - CVE-2026-14457", " * SECURITY UPDATE: QUIC Server May Trigger Double Free When Processing", " INITIAL Packet", " - debian/patches/CVE-2026-18798-pre1.patch: quic: remove unused scid from", " port_default_packet_handler in include/internal/quic_channel.h,", " ssl/quic/quic_channel.c, ssl/quic/quic_port.c.", " - debian/patches/CVE-2026-18798.patch: Avoid double free of qrx in", " port_default_packet_handler() in include/internal/quic_record_rx.h,", " ssl/quic/quic_port.c, ssl/quic/quic_record_rx.c.", " - CVE-2026-18798", " * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future", " Epoch", " - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation", " when buffering DTLS next-epoch records in ssl/record/methods/dtls_meth.c.", " - debian/patches/CVE-2026-54874-2.patch: ssl/record/methods/dtls_meth.c:", " lower the unprocessed_rcds queue limit in ssl/record/methods/dtls_meth.c.", " - debian/patches/CVE-2026-54874-3.patch: ssl/record: remove dead DTLS", " processed_rcds record queue in ssl/record/methods/dtls_meth.c,", " ssl/record/methods/recmethod_local.h.", " - CVE-2026-54874", " * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping", " - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in", " test/cmsapitest.c, test/recipes/80-test_cmsapi.t.", " - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte", " OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.", " - CVE-2026-63072", " * SECURITY UPDATE: Untrusted Sender DN Used as Format String in CMP Response", " Validation", " - debian/patches/CVE-2026-63073-1.patch: CMP unexpected sender DN used as", " format string in ERR_raise_data() in crypto/cmp/cmp_vfy.c.", " - debian/patches/CVE-2026-63073-2.patch: Add test for CVE-2026-63073 in", " test/cmp_vfy_test.c.", " - CVE-2026-63073", " * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts", " - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth", " in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,", " test/recipes/65-test_cmp_msg.t.", " - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in", " cmp in crypto/cmp/cmp_vfy.c.", " - CVE-2026-63074", " * SECURITY UPDATE: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion", " - debian/patches/CVE-2026-63075.patch: Don't store ACK-only frames in TX", " history for QUIC. in include/internal/quic_ackm.h, ssl/quic/quic_ackm.c,", " ssl/quic/quic_txp.c.", " - CVE-2026-63075", " * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted", " protectionAlg", " - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in", " test/cmp_protect_test.c.", " - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in", " ossl_cmp_calc_protection() via crafted protectionAlg in", " crypto/cmp/cmp_protect.c.", " - CVE-2026-63076", "" ], "package": "openssl", "version": "3.5.5-1ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 18 Aug 2026 07:56:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libudisks2-0:armhf", "from_version": { "source_package_name": "udisks2", "source_package_version": "2.10.91-1ubuntu2", "version": "2.10.91-1ubuntu2" }, "to_version": { "source_package_name": "udisks2", "source_package_version": "2.10.91-1ubuntu2.1", "version": "2.10.91-1ubuntu2.1" }, "cves": [ { "cve": "CVE-2026-7867", "url": "https://ubuntu.com/security/CVE-2026-7867", "cve_description": "A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.", "cve_priority": "medium", "cve_public_date": "2026-08-06 22:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-7867", "url": "https://ubuntu.com/security/CVE-2026-7867", "cve_description": "A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.", "cve_priority": "medium", "cve_public_date": "2026-08-06 22:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Privilege escalation via mount point injection", " - debian/patches/CVE-2026-7867-1.patch: udiskslinuxfilesystem: Separate real", " caller identity from as-user target in src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-2.patch: udiskslinuxfilesystem: Rework fstab", " mount authorization for as-user in data/org.freedesktop.UDisks2.xml,", " src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-3.patch: udiskslinuxfilesystem: Log real", " caller uid for as-user mounts in src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-4.patch: udisksdaemonutil: Pass as-user", " target to polkit details in src/udisksdaemonutil.c.", " - debian/patches/CVE-2026-7867-5.patch: tests: Add security tests for as-", " user mount authorization in src/tests/dbus-tests/test_80_filesystem.py.", " - CVE-2026-7867", "" ], "package": "udisks2", "version": "2.10.91-1ubuntu2.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 17 Aug 2026 10:41:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libuuid1:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-generic", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31", "" ], "package": "linux-meta", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:01:20 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31", "" ], "package": "linux-meta", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:01:20 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31", "" ], "package": "linux-meta", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:01:20 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-libc-dev:armhf", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", "", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", "", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", "", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", "", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", "", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", "", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", "", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", "", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", "", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", "", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", "", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", "", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", "", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", "", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:09:29 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-common", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", "", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", "", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", "", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", "", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", "", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", "", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", "", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", "", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", "", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", "", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", "", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", "", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", "", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", "", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:09:29 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31", "" ], "package": "linux-meta", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:01:20 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "locales", "from_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.3", "version": "2.43-2ubuntu2.3" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.4", "version": "2.43-2ubuntu2.4" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.43-2ubuntu2.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:09:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "login", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "1:4.16.0-2+really2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "1:4.16.0-2+really2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "mdadm", "from_version": { "source_package_name": "mdadm", "source_package_version": "4.5-5ubuntu1", "version": "4.5-5ubuntu1" }, "to_version": { "source_package_name": "mdadm", "source_package_version": "4.5-5ubuntu1.1", "version": "4.5-5ubuntu1.1" }, "cves": [], "launchpad_bugs_fixed": [ 2162687 ], "changes": [ { "cves": [], "log": [ "", " * Use mdcheck from the built tree rather than the source, fixing the", " missing BINDIR reference (LP: #2162687)", "" ], "package": "mdadm", "version": "4.5-5ubuntu1.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162687 ], "author": "Dave Jones ", "date": "Sun, 02 Aug 2026 22:41:30 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "motd-news-config", "from_version": { "source_package_name": "base-files", "source_package_version": "14ubuntu6.1", "version": "14ubuntu6.1" }, "to_version": { "source_package_name": "base-files", "source_package_version": "14ubuntu6.2", "version": "14ubuntu6.2" }, "cves": [], "launchpad_bugs_fixed": [ 2164885 ], "changes": [ { "cves": [], "log": [ "", " * /etc/issue{,.net}, /etc/{lsb,os}-release: bump version to 26.04.1", " (LP: #2164885)", "" ], "package": "base-files", "version": "14ubuntu6.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2164885 ], "author": "Oliver Reiche ", "date": "Mon, 24 Aug 2026 12:33:48 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "mount", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "netplan-generator", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.2-1ubuntu5", "version": "1.2-1ubuntu5" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.2-1ubuntu5.1", "version": "1.2-1ubuntu5.1" }, "cves": [], "launchpad_bugs_fixed": [ 2104373 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2104373-return-exit-code-1-on-error.patch: return exit code 1 when", " netplan exits on error (LP: #2104373)", "" ], "package": "netplan.io", "version": "1.2-1ubuntu5.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2104373 ], "author": "Guilherme Puida Moreira ", "date": "Mon, 31 Aug 2026 09:23:48 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "netplan.io", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.2-1ubuntu5", "version": "1.2-1ubuntu5" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.2-1ubuntu5.1", "version": "1.2-1ubuntu5.1" }, "cves": [], "launchpad_bugs_fixed": [ 2104373 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2104373-return-exit-code-1-on-error.patch: return exit code 1 when", " netplan exits on error (LP: #2104373)", "" ], "package": "netplan.io", "version": "1.2-1ubuntu5.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2104373 ], "author": "Guilherme Puida Moreira ", "date": "Mon, 31 Aug 2026 09:23:48 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.5", "version": "1:10.2p1-2ubuntu3.5" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.6", "version": "1:10.2p1-2ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.6", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:36:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.5", "version": "1:10.2p1-2ubuntu3.5" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.6", "version": "1:10.2p1-2ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.6", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:36:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.5", "version": "1:10.2p1-2ubuntu3.5" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.6", "version": "1:10.2p1-2ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.6", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:36:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl", "from_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.3", "version": "3.5.5-1ubuntu3.3" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.5", "version": "3.5.5-1ubuntu3.5" }, "cves": [ { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using", " EVP_Cipher()", " - debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()", " finalize: Poly1305 and OCB AEADs in", " providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c,", " providers/implementations/ciphers/cipher_aes_ocb.c,", " providers/implementations/ciphers/cipher_chacha20_poly1305.c.", " - debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD", " EVP_Cipher() finalization in test/evp_extra_test.c.", " - CVE-2026-75803", "" ], "package": "openssl", "version": "3.5.5-1ubuntu3.5", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 26 Aug 2026 07:58:23 -0400" }, { "cves": [ { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unbounded Memory Growth in QUIC Server Incoming Channel", " Queue", " - debian/patches/CVE-2026-14456.patch: QUIC server: limit number of pending", " QUIC channels/connections in doc/man3/SSL_get_value_uint.pod,", " include/internal/quic_port.h, include/openssl/ssl.h.in,", " ssl/quic/quic_impl.c, ssl/quic/quic_port.c, ssl/quic/quic_port_local.h,", " util/other.syms.", " - CVE-2026-14456", " * SECURITY UPDATE: RPK Server Signature Algorithm Selection Can Dereference", " a Missing Certificate", " - debian/patches/CVE-2026-14457.patch: Handle signature_algorithms_cert", " extension in key-only context in ssl/t1_lib.c, test/rpktest.c.", " - CVE-2026-14457", " * SECURITY UPDATE: QUIC Server May Trigger Double Free When Processing", " INITIAL Packet", " - debian/patches/CVE-2026-18798-pre1.patch: quic: remove unused scid from", " port_default_packet_handler in include/internal/quic_channel.h,", " ssl/quic/quic_channel.c, ssl/quic/quic_port.c.", " - debian/patches/CVE-2026-18798.patch: Avoid double free of qrx in", " port_default_packet_handler() in include/internal/quic_record_rx.h,", " ssl/quic/quic_port.c, ssl/quic/quic_record_rx.c.", " - CVE-2026-18798", " * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future", " Epoch", " - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation", " when buffering DTLS next-epoch records in ssl/record/methods/dtls_meth.c.", " - debian/patches/CVE-2026-54874-2.patch: ssl/record/methods/dtls_meth.c:", " lower the unprocessed_rcds queue limit in ssl/record/methods/dtls_meth.c.", " - debian/patches/CVE-2026-54874-3.patch: ssl/record: remove dead DTLS", " processed_rcds record queue in ssl/record/methods/dtls_meth.c,", " ssl/record/methods/recmethod_local.h.", " - CVE-2026-54874", " * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping", " - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in", " test/cmsapitest.c, test/recipes/80-test_cmsapi.t.", " - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte", " OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.", " - CVE-2026-63072", " * SECURITY UPDATE: Untrusted Sender DN Used as Format String in CMP Response", " Validation", " - debian/patches/CVE-2026-63073-1.patch: CMP unexpected sender DN used as", " format string in ERR_raise_data() in crypto/cmp/cmp_vfy.c.", " - debian/patches/CVE-2026-63073-2.patch: Add test for CVE-2026-63073 in", " test/cmp_vfy_test.c.", " - CVE-2026-63073", " * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts", " - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth", " in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,", " test/recipes/65-test_cmp_msg.t.", " - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in", " cmp in crypto/cmp/cmp_vfy.c.", " - CVE-2026-63074", " * SECURITY UPDATE: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion", " - debian/patches/CVE-2026-63075.patch: Don't store ACK-only frames in TX", " history for QUIC. in include/internal/quic_ackm.h, ssl/quic/quic_ackm.c,", " ssl/quic/quic_txp.c.", " - CVE-2026-63075", " * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted", " protectionAlg", " - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in", " test/cmp_protect_test.c.", " - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in", " ossl_cmp_calc_protection() via crafted protectionAlg in", " crypto/cmp/cmp_protect.c.", " - CVE-2026-63076", "" ], "package": "openssl", "version": "3.5.5-1ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 18 Aug 2026 07:56:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl-provider-legacy", "from_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.3", "version": "3.5.5-1ubuntu3.3" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.5", "version": "3.5.5-1ubuntu3.5" }, "cves": [ { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using", " EVP_Cipher()", " - debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()", " finalize: Poly1305 and OCB AEADs in", " providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c,", " providers/implementations/ciphers/cipher_aes_ocb.c,", " providers/implementations/ciphers/cipher_chacha20_poly1305.c.", " - debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD", " EVP_Cipher() finalization in test/evp_extra_test.c.", " - CVE-2026-75803", "" ], "package": "openssl", "version": "3.5.5-1ubuntu3.5", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 26 Aug 2026 07:58:23 -0400" }, { "cves": [ { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unbounded Memory Growth in QUIC Server Incoming Channel", " Queue", " - debian/patches/CVE-2026-14456.patch: QUIC server: limit number of pending", " QUIC channels/connections in doc/man3/SSL_get_value_uint.pod,", " include/internal/quic_port.h, include/openssl/ssl.h.in,", " ssl/quic/quic_impl.c, ssl/quic/quic_port.c, ssl/quic/quic_port_local.h,", " util/other.syms.", " - CVE-2026-14456", " * SECURITY UPDATE: RPK Server Signature Algorithm Selection Can Dereference", " a Missing Certificate", " - debian/patches/CVE-2026-14457.patch: Handle signature_algorithms_cert", " extension in key-only context in ssl/t1_lib.c, test/rpktest.c.", " - CVE-2026-14457", " * SECURITY UPDATE: QUIC Server May Trigger Double Free When Processing", " INITIAL Packet", " - debian/patches/CVE-2026-18798-pre1.patch: quic: remove unused scid from", " port_default_packet_handler in include/internal/quic_channel.h,", " ssl/quic/quic_channel.c, ssl/quic/quic_port.c.", " - debian/patches/CVE-2026-18798.patch: Avoid double free of qrx in", " port_default_packet_handler() in include/internal/quic_record_rx.h,", " ssl/quic/quic_port.c, ssl/quic/quic_record_rx.c.", " - CVE-2026-18798", " * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future", " Epoch", " - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation", " when buffering DTLS next-epoch records in ssl/record/methods/dtls_meth.c.", " - debian/patches/CVE-2026-54874-2.patch: ssl/record/methods/dtls_meth.c:", " lower the unprocessed_rcds queue limit in ssl/record/methods/dtls_meth.c.", " - debian/patches/CVE-2026-54874-3.patch: ssl/record: remove dead DTLS", " processed_rcds record queue in ssl/record/methods/dtls_meth.c,", " ssl/record/methods/recmethod_local.h.", " - CVE-2026-54874", " * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping", " - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in", " test/cmsapitest.c, test/recipes/80-test_cmsapi.t.", " - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte", " OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.", " - CVE-2026-63072", " * SECURITY UPDATE: Untrusted Sender DN Used as Format String in CMP Response", " Validation", " - debian/patches/CVE-2026-63073-1.patch: CMP unexpected sender DN used as", " format string in ERR_raise_data() in crypto/cmp/cmp_vfy.c.", " - debian/patches/CVE-2026-63073-2.patch: Add test for CVE-2026-63073 in", " test/cmp_vfy_test.c.", " - CVE-2026-63073", " * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts", " - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth", " in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,", " test/recipes/65-test_cmp_msg.t.", " - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in", " cmp in crypto/cmp/cmp_vfy.c.", " - CVE-2026-63074", " * SECURITY UPDATE: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion", " - debian/patches/CVE-2026-63075.patch: Don't store ACK-only frames in TX", " history for QUIC. in include/internal/quic_ackm.h, ssl/quic/quic_ackm.c,", " ssl/quic/quic_txp.c.", " - CVE-2026-63075", " * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted", " protectionAlg", " - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in", " test/cmp_protect_test.c.", " - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in", " ossl_cmp_calc_protection() via crafted protectionAlg in", " crypto/cmp/cmp_protect.c.", " - CVE-2026-63076", "" ], "package": "openssl", "version": "3.5.5-1ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 18 Aug 2026 07:56:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl", "from_version": { "source_package_name": "perl", "source_package_version": "5.40.1-7ubuntu0.1", "version": "5.40.1-7ubuntu0.1" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.40.1-7ubuntu0.3", "version": "5.40.1-7ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", "" ], "package": "perl", "version": "5.40.1-7ubuntu0.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 08 Sep 2026 14:17:45 -0400" }, { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.40.1-7ubuntu0.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:10 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.40.1-7ubuntu0.1", "version": "5.40.1-7ubuntu0.1" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.40.1-7ubuntu0.3", "version": "5.40.1-7ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", "" ], "package": "perl", "version": "5.40.1-7ubuntu0.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 08 Sep 2026 14:17:45 -0400" }, { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.40.1-7ubuntu0.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:10 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-modules-5.40", "from_version": { "source_package_name": "perl", "source_package_version": "5.40.1-7ubuntu0.1", "version": "5.40.1-7ubuntu0.1" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.40.1-7ubuntu0.3", "version": "5.40.1-7ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", "" ], "package": "perl", "version": "5.40.1-7ubuntu0.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 08 Sep 2026 14:17:45 -0400" }, { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.40.1-7ubuntu0.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:10 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "polkitd", "from_version": { "source_package_name": "policykit-1", "source_package_version": "127-2ubuntu1", "version": "127-2ubuntu1" }, "to_version": { "source_package_name": "policykit-1", "source_package_version": "127-2ubuntu1.1", "version": "127-2ubuntu1.1" }, "cves": [ { "cve": "CVE-2026-85498", "url": "https://ubuntu.com/security/CVE-2026-85498", "cve_description": "[Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow]", "cve_priority": "medium", "cve_public_date": "2026-09-07" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-85498", "url": "https://ubuntu.com/security/CVE-2026-85498", "cve_description": "[Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow]", "cve_priority": "medium", "cve_public_date": "2026-09-07" } ], "log": [ "", " * SECURITY UPDATE: stack underflow in cookie input", " - debian/patches/CVE-2026-85498.patch: Unsanitized underflow in cookie", " input in src/polkitagent/polkitagenthelperprivate.c.", " - CVE-2026-85498", "" ], "package": "policykit-1", "version": "127-2ubuntu1.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 11 Sep 2026 13:30:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python-apt-common", "from_version": { "source_package_name": "python-apt", "source_package_version": "3.1.0ubuntu1", "version": "3.1.0ubuntu1" }, "to_version": { "source_package_name": "python-apt", "source_package_version": "3.1.0ubuntu1.1", "version": "3.1.0ubuntu1.1" }, "cves": [], "launchpad_bugs_fixed": [ 2164900 ], "changes": [ { "cves": [], "log": [ "", " * Refresh mirror list (LP: #2164900)", "" ], "package": "python-apt", "version": "3.1.0ubuntu1.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2164900 ], "author": "Paride Legovini ", "date": "Mon, 24 Aug 2026 14:44:07 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-apt", "from_version": { "source_package_name": "python-apt", "source_package_version": "3.1.0ubuntu1", "version": "3.1.0ubuntu1" }, "to_version": { "source_package_name": "python-apt", "source_package_version": "3.1.0ubuntu1.1", "version": "3.1.0ubuntu1.1" }, "cves": [], "launchpad_bugs_fixed": [ 2164900 ], "changes": [ { "cves": [], "log": [ "", " * Refresh mirror list (LP: #2164900)", "" ], "package": "python-apt", "version": "3.1.0ubuntu1.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2164900 ], "author": "Paride Legovini ", "date": "Mon, 24 Aug 2026 14:44:07 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-cryptography", "from_version": { "source_package_name": "python-cryptography", "source_package_version": "46.0.5-1ubuntu2", "version": "46.0.5-1ubuntu2" }, "to_version": { "source_package_name": "python-cryptography", "source_package_version": "46.0.5-1ubuntu2.2", "version": "46.0.5-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-69247", "url": "https://ubuntu.com/security/CVE-2026-69247", "cve_description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.", "cve_priority": "medium", "cve_public_date": "2026-08-03 22:16:00 UTC" }, { "cve": "CVE-2026-69248", "url": "https://ubuntu.com/security/CVE-2026-69248", "cve_description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.", "cve_priority": "medium", "cve_public_date": "2026-08-03 22:16:00 UTC" }, { "cve": "CVE-2026-69249", "url": "https://ubuntu.com/security/CVE-2026-69249", "cve_description": "python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.", "cve_priority": "medium", "cve_public_date": "2026-08-03 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-69247", "url": "https://ubuntu.com/security/CVE-2026-69247", "cve_description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.", "cve_priority": "medium", "cve_public_date": "2026-08-03 22:16:00 UTC" }, { "cve": "CVE-2026-69248", "url": "https://ubuntu.com/security/CVE-2026-69248", "cve_description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.", "cve_priority": "medium", "cve_public_date": "2026-08-03 22:16:00 UTC" }, { "cve": "CVE-2026-69249", "url": "https://ubuntu.com/security/CVE-2026-69249", "cve_description": "python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.", "cve_priority": "medium", "cve_public_date": "2026-08-03 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sensitive decryption data is leaked", " - debian/patches/CVE-2026-69247.patch: don't leak how PKCS#7 encryptedKey", " decryption failed in docs/hazmat/primitives/asymmetric/serialization.rst,", " docs/spelling_wordlist.txt, src/rust/src/pkcs7.rs, tests/doubles.py,", " tests/hazmat/primitives/test_pkcs7.py.", " - CVE-2026-69247", " * SECURITY UPDATE: acceptance of non-permitted DNS names", " - debian/patches/CVE-2026-69248.patch: distinguish NC kinds when", " evaluating wildcard DNS SANs in", " src/rust/cryptography-x509-verification/src/lib.rs,", " src/rust/cryptography-x509-verification/src/types.rs.", " - CVE-2026-69248", " * SECURITY UPDATE: exponential processing of invalid certificates", " - debian/patches/CVE-2026-69249.patch: add a signature validation budget", " during path construction in", " src/rust/cryptography-x509-verification/src/lib.rs,", " src/rust/cryptography-x509-verification/src/policy/mod.rs.", " - CVE-2026-69249", "" ], "package": "python-cryptography", "version": "46.0.5-1ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Fri, 04 Sep 2026 17:24:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-distupgrade", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.04.22", "version": "1:26.04.22" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.04.23", "version": "1:26.04.23" }, "cves": [], "launchpad_bugs_fixed": [ 2164900 ], "changes": [ { "cves": [], "log": [ "", " * Refresh mirror list (LP: #2164900)", "" ], "package": "ubuntu-release-upgrader", "version": "1:26.04.23", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2164900 ], "author": "Paride Legovini ", "date": "Mon, 24 Aug 2026 16:06:51 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-netplan", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.2-1ubuntu5", "version": "1.2-1ubuntu5" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.2-1ubuntu5.1", "version": "1.2-1ubuntu5.1" }, "cves": [], "launchpad_bugs_fixed": [ 2104373 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2104373-return-exit-code-1-on-error.patch: return exit code 1 when", " netplan exits on error (LP: #2104373)", "" ], "package": "netplan.io", "version": "1.2-1ubuntu5.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2104373 ], "author": "Guilherme Puida Moreira ", "date": "Mon, 31 Aug 2026 09:23:48 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-pyasn1", "from_version": { "source_package_name": "pyasn1", "source_package_version": "0.6.3-1", "version": "0.6.3-1" }, "to_version": { "source_package_name": "pyasn1", "source_package_version": "0.6.3-1ubuntu0.1", "version": "0.6.3-1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-59886", "url": "https://ubuntu.com/security/CVE-2026-59886", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59884", "url": "https://ubuntu.com/security/CVE-2026-59884", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59885", "url": "https://ubuntu.com/security/CVE-2026-59885", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59886", "url": "https://ubuntu.com/security/CVE-2026-59886", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59884", "url": "https://ubuntu.com/security/CVE-2026-59884", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59885", "url": "https://ubuntu.com/security/CVE-2026-59885", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pyasn1 BER/CER/DER decoder denial of service via", " unbounded long-form tag IDs ", " - debian/patches/CVE-2026-59886.patch: Merge commit from fork in", " pyasn1/type/univ.py, tests/codec/ber/test_decoder.py,", " tests/codec/cer/test_decoder.py, tests/codec/der/test_decoder.py,", " tests/type/test_univ.py.", " - CVE-2026-59886", " * SECURITY UPDATE: Quadratic complexity in OBJECT IDENTIFIER and", " RELATIVE-OID processing allows denial of service", " - debian/patches/CVE-2026-59884.patch: Merge commit from fork in", " pyasn1/codec/ber/decoder.py, pyasn1/type/tag.py,", " tests/codec/ber/test_decoder.py, tests/codec/cer/test_decoder.py,", " tests/codec/der/test_decoder.py, tests/type/test_tag.py.", " - CVE-2026-59884", " * SECURITY UPDATE: Uncontrolled resource consumption when converting", " decoded REAL values", " - debian/patches/CVE-2026-59885.patch: Merge commit from fork in", " pyasn1/codec/ber/decoder.py, pyasn1/codec/ber/encoder.py,", " tests/codec/ber/test_decoder.py, tests/codec/ber/test_encoder.py.", " - CVE-2026-59885", "" ], "package": "pyasn1", "version": "0.6.3-1ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 20 Aug 2026 13:20:40 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.14", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.1", "version": "3.14.4-1ubuntu0.1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.2", "version": "3.14.4-1ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.14", "version": "3.14.4-1ubuntu0.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 20 Aug 2026 11:41:58 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.14-gdbm", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.1", "version": "3.14.4-1ubuntu0.1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.2", "version": "3.14.4-1ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.14", "version": "3.14.4-1ubuntu0.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 20 Aug 2026 11:41:58 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.14-minimal", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.1", "version": "3.14.4-1ubuntu0.1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.4-1ubuntu0.2", "version": "3.14.4-1ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.14", "version": "3.14.4-1ubuntu0.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 20 Aug 2026 11:41:58 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "sos", "from_version": { "source_package_name": "sos", "source_package_version": "4.10.2-1", "version": "4.10.2-1" }, "to_version": { "source_package_name": "sos", "source_package_version": "4.11.2-0ubuntu0.1", "version": "4.11.2-0ubuntu0.1" }, "cves": [], "launchpad_bugs_fixed": [ 2156921 ], "changes": [ { "cves": [], "log": [ "", " * New 4.11.2 upstream release. (LP: #2156921)", "", " * For more details, full release note is available here:", " - https://github.com/sosreport/sos/releases/tag/4.11.2", "", " * d/t/simple.sh: Remove Failure if /proc/timer* not Captured", "", " * d/control:", " - Update Vcs-Browser and Vcs-Git to reflect the Salsa repository migration", " to Debian Python Team", " - Add xz-utils to Depends", "", " * d/copyright: Aligned copyright with Debian", "" ], "package": "sos", "version": "4.11.2-0ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2156921 ], "author": "Bryan Fraschetti ", "date": "Wed, 17 Jun 2026 11:43:07 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "sudo-rs", "from_version": { "source_package_name": "rust-sudo-rs", "source_package_version": "0.2.13-0ubuntu1", "version": "0.2.13-0ubuntu1" }, "to_version": { "source_package_name": "rust-sudo-rs", "source_package_version": "0.2.13-0ubuntu1.2", "version": "0.2.13-0ubuntu1.2" }, "cves": [], "launchpad_bugs_fixed": [ 2165142, 2158541, 2153817 ], "changes": [ { "cves": [], "log": [ "", " * d/patches/fix-sudoedit.patch: Fix privilege escalation race in sudoedit", " (LP: #2165142)", "" ], "package": "rust-sudo-rs", "version": "0.2.13-0ubuntu1.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2165142 ], "author": "Simon Johnsson ", "date": "Thu, 27 Aug 2026 10:15:26 +0200" }, { "cves": [], "log": [ "", " * Backport upstream patches:", " - flexible-array-sizes-for-groups: Fix an error where sudo would fail on", " large groups (LP: #2158541)", " - improve-res-set-valid-pam-tty: Fix wrongly computed PAM_TTY", " (LP: #2153817)", "" ], "package": "rust-sudo-rs", "version": "0.2.13-0ubuntu1.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158541, 2153817 ], "author": "Simon Johnsson ", "date": "Thu, 09 Jul 2026 09:35:34 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-release-upgrader-core", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.04.22", "version": "1:26.04.22" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.04.23", "version": "1:26.04.23" }, "cves": [], "launchpad_bugs_fixed": [ 2164900 ], "changes": [ { "cves": [], "log": [ "", " * Refresh mirror list (LP: #2164900)", "" ], "package": "ubuntu-release-upgrader", "version": "1:26.04.23", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2164900 ], "author": "Paride Legovini ", "date": "Mon, 24 Aug 2026 16:06:51 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "udisks2", "from_version": { "source_package_name": "udisks2", "source_package_version": "2.10.91-1ubuntu2", "version": "2.10.91-1ubuntu2" }, "to_version": { "source_package_name": "udisks2", "source_package_version": "2.10.91-1ubuntu2.1", "version": "2.10.91-1ubuntu2.1" }, "cves": [ { "cve": "CVE-2026-7867", "url": "https://ubuntu.com/security/CVE-2026-7867", "cve_description": "A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.", "cve_priority": "medium", "cve_public_date": "2026-08-06 22:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-7867", "url": "https://ubuntu.com/security/CVE-2026-7867", "cve_description": "A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.", "cve_priority": "medium", "cve_public_date": "2026-08-06 22:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Privilege escalation via mount point injection", " - debian/patches/CVE-2026-7867-1.patch: udiskslinuxfilesystem: Separate real", " caller identity from as-user target in src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-2.patch: udiskslinuxfilesystem: Rework fstab", " mount authorization for as-user in data/org.freedesktop.UDisks2.xml,", " src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-3.patch: udiskslinuxfilesystem: Log real", " caller uid for as-user mounts in src/udiskslinuxfilesystem.c.", " - debian/patches/CVE-2026-7867-4.patch: udisksdaemonutil: Pass as-user", " target to polkit details in src/udisksdaemonutil.c.", " - debian/patches/CVE-2026-7867-5.patch: tests: Add security tests for as-", " user mount authorization in src/tests/dbus-tests/test_80_filesystem.py.", " - CVE-2026-7867", "" ], "package": "udisks2", "version": "2.10.91-1ubuntu2.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 17 Aug 2026 10:41:39 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "util-linux", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "util-linux-extra", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "uuid-runtime", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2.2", "version": "2.41.3-3ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Improper hostname canonicalization in login", " - debian/patches/CVE-2026-3184.patch: login: use original FQDN for PAM_RHOST", " in login-utils/login.c.", " - CVE-2026-3184", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", " * debian/patches/tests-fincore-force-the-use-of-GNU-dd-over-uutils.patch:", " fix ftbfs on arm64 and armhf.", "" ], "package": "util-linux", "version": "2.41.3-3ubuntu2.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 10:23:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.8", "version": "2:9.1.2141-1ubuntu4.8" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.9", "version": "2:9.1.2141-1ubuntu4.9" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.", "cve_priority": "medium", "cve_public_date": "2026-08-18 16:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.", "cve_priority": "medium", "cve_public_date": "2026-08-18 16:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:9.1.2141-1ubuntu4.9", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:11:12 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-common", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.8", "version": "2:9.1.2141-1ubuntu4.8" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.9", "version": "2:9.1.2141-1ubuntu4.9" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.", "cve_priority": "medium", "cve_public_date": "2026-08-18 16:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.", "cve_priority": "medium", "cve_public_date": "2026-08-18 16:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:9.1.2141-1ubuntu4.9", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:11:12 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-runtime", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.8", "version": "2:9.1.2141-1ubuntu4.8" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.9", "version": "2:9.1.2141-1ubuntu4.9" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.", "cve_priority": "medium", "cve_public_date": "2026-08-18 16:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.", "cve_priority": "medium", "cve_public_date": "2026-08-18 16:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:9.1.2141-1ubuntu4.9", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:11:12 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-tiny", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.8", "version": "2:9.1.2141-1ubuntu4.8" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.9", "version": "2:9.1.2141-1ubuntu4.9" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.", "cve_priority": "medium", "cve_public_date": "2026-08-18 16:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.", "cve_priority": "medium", "cve_public_date": "2026-08-18 16:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:9.1.2141-1ubuntu4.9", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:11:12 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "wireless-regdb", "from_version": { "source_package_name": "wireless-regdb", "source_package_version": "2026.02.04-0ubuntu1", "version": "2026.02.04-0ubuntu1" }, "to_version": { "source_package_name": "wireless-regdb", "source_package_version": "2026.05.30-0ubuntu1~26.04.1", "version": "2026.05.30-0ubuntu1~26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2163172, 2163172 ], "changes": [ { "cves": [], "log": [ "", " * Backport 2026.05.30-0ubuntu1 to Resolute (LP: #2163172)", "" ], "package": "wireless-regdb", "version": "2026.05.30-0ubuntu1~26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2163172 ], "author": "Jacob Martin ", "date": "Mon, 17 Aug 2026 12:26:23 -0500" }, { "cves": [], "log": [ "", " * New upstream version 2026.05.30 (LP: #2163172)", " - debian/control: Exchange python3-m2crypto build dependency for", " python3-cryptography", "" ], "package": "wireless-regdb", "version": "2026.05.30-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2163172 ], "author": "Jacob Martin ", "date": "Mon, 10 Aug 2026 10:02:11 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "xxd", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.8", "version": "2:9.1.2141-1ubuntu4.8" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.9", "version": "2:9.1.2141-1ubuntu4.9" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.", "cve_priority": "medium", "cve_public_date": "2026-08-18 16:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.", "cve_priority": "medium", "cve_public_date": "2026-08-18 16:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:9.1.2141-1ubuntu4.9", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:11:12 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "zlib1g:armhf", "from_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg+really1.3.1-1ubuntu3", "version": "1:1.3.dfsg+really1.3.1-1ubuntu3" }, "to_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg+really1.3.1-1ubuntu3.1", "version": "1:1.3.dfsg+really1.3.1-1ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-27171", "url": "https://ubuntu.com/security/CVE-2026-27171", "cve_description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "cve_priority": "low", "cve_public_date": "2026-02-18 04:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-27171", "url": "https://ubuntu.com/security/CVE-2026-27171", "cve_description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "cve_priority": "low", "cve_public_date": "2026-02-18 04:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: resource consumption via infinite loop", " - debian/patches/CVE-2026-27171.patch: add negative length checks to", " crc32_combine64 and crc32_combine_gen64 functions in crc32.c", " - CVE-2026-27171", " * Thanks to Mark Adler for the upstream fix.", "" ], "package": "zlib", "version": "1:1.3.dfsg+really1.3.1-1ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Tue, 25 Aug 2026 13:41:32 +0300" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-headers-7.0.0-31", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", "", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", "", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", "", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", "", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", "", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", "", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", "", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", "", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", "", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", "", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", "", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", "", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", "", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", "", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:09:29 +0200" } ], "notes": "linux-headers-7.0.0-31 version '7.0.0-31.31' (source package linux version '7.0.0-31.31') was added. linux-headers-7.0.0-31 version '7.0.0-31.31' has the same source package name, linux, as removed package linux-headers-7.0.0-30. As such we can use the source package version of the removed package, '7.0.0-30.30', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-headers-7.0.0-31-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", "", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", "", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", "", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", "", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", "", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", "", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", "", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", "", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", "", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", "", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", "", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", "", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", "", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", "", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:09:29 +0200" } ], "notes": "linux-headers-7.0.0-31-generic version '7.0.0-31.31' (source package linux version '7.0.0-31.31') was added. linux-headers-7.0.0-31-generic version '7.0.0-31.31' has the same source package name, linux, as removed package linux-headers-7.0.0-30. As such we can use the source package version of the removed package, '7.0.0-30.30', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-image-7.0.0-31-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", "", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", "", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", "", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", "", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", "", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", "", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", "", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", "", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", "", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", "", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", "", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", "", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", "", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", "", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:09:29 +0200" } ], "notes": "linux-image-7.0.0-31-generic version '7.0.0-31.31' (source package linux version '7.0.0-31.31') was added. linux-image-7.0.0-31-generic version '7.0.0-31.31' has the same source package name, linux, as removed package linux-headers-7.0.0-30. As such we can use the source package version of the removed package, '7.0.0-30.30', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-31-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", "", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", "", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", "", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", "", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", "", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", "", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", "", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", "", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", "", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", "", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", "", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", "", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", "", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", "", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:09:29 +0200" } ], "notes": "linux-modules-7.0.0-31-generic version '7.0.0-31.31' (source package linux version '7.0.0-31.31') was added. linux-modules-7.0.0-31-generic version '7.0.0-31.31' has the same source package name, linux, as removed package linux-headers-7.0.0-30. As such we can use the source package version of the removed package, '7.0.0-30.30', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-7.0.0-31", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", "", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", "", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", "", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", "", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", "", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", "", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", "", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", "", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", "", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", "", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", "", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", "", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", "", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", "", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:09:29 +0200" } ], "notes": "linux-tools-7.0.0-31 version '7.0.0-31.31' (source package linux version '7.0.0-31.31') was added. linux-tools-7.0.0-31 version '7.0.0-31.31' has the same source package name, linux, as removed package linux-headers-7.0.0-30. As such we can use the source package version of the removed package, '7.0.0-30.30', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-7.0.0-31-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", "", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", "", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", "", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", "", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", "", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", "", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", "", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", "", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", "", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", "", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", "", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", "", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", "", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", "", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:09:29 +0200" } ], "notes": "linux-tools-7.0.0-31-generic version '7.0.0-31.31' (source package linux version '7.0.0-31.31') was added. linux-tools-7.0.0-31-generic version '7.0.0-31.31' has the same source package name, linux, as removed package linux-headers-7.0.0-30. As such we can use the source package version of the removed package, '7.0.0-30.30', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-headers-7.0.0-30", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-7.0.0-30-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-7.0.0-30-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-30-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-7.0.0-30", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-7.0.0-30-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.04 resolute image from daily image serial 20260823 to 20260918", "from_series": "resolute", "to_series": "resolute", "from_serial": "20260823", "to_serial": "20260918", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }