Skip to content
OpenAdvisories
Critical LSN-0119-1 8 CVEs

Kernel Live Patch Security Notice

Published Apr 13, 2026 · Updated Sep 30, 2026

Ecosystem: Ubuntu

Summary

In the Linux kernel, the following vulnerability has been
resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At
btrfs_ref_tree_mod() after we successfully inserted the new ref entry
(local variable 'ref') into the respective block entry's rbtree (local
variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF,
we error out and free the ref entry without removing it from the block
entry's rbtree.

In the Linux kernel, the following vulnerability has been
resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in
brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in
brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g.
512) and a lot of queued SKBs are sent from the pkt queue.

In the Linux kernel, the following vulnerability has been
resolved: net/smc: fix LGR and link use-after-free issue We encountered a
LGR/link use-after-free issue, which manifested as the LGR/link refcnt
reaching 0 early and entering the clear process, making resource access
unsafe.

In the Linux kernel, the following vulnerability has been
resolved: usb: cdc-acm: Check control transfer buffer size before access If
the first fragment is shorter than struct usb_cdc_notification, we can't
calculate an expected_size.

In the Linux kernel, the following vulnerability has been
resolved: drm/amdgpu: avoid buffer overflow attach in
smu_sys_set_pp_table() It malicious user provides a small pptable through
sysfs and then a bigger pptable, it may cause buffer overflow attack in
function smu_sys_set_pp_table().)(CVE-2025-21780).

In the Linux kernel, the following vulnerability has been
resolved: netfilter: nf_tables: fix inverted genmask check in
nft_map_catchall_activate() nft_map_catchall_activate() has an inverted
element activity check compared to its non-catchall counterpart
nft_mapelem_activate() and compared to what is logically required.
nft_map_catchall_activate() is called from the abort path to re-activate
catchall map elements that were deactivated during a failed transaction.

Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.)(CVE-2026-23268)

Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.)(CVE-2026-23269)

Fixed packages 35

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-aws-hwe 4.15.0-1191.204~16.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-azure 4.15.0-1200.215~16.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-hwe 4.15.0-249.261~16.04.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux 4.15.0-249.261
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-aws 4.15.0-1191.204
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-azure-4.15 4.15.0-1200.215
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-gcp-4.15 4.15.0-1184.201
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-hwe-5.4 5.4.0-227.247~18.04.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-oracle 4.15.0-1153.164
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux 5.4.0-227.247
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-aws 5.4.0-1156.166
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-aws-5.15 5.15.0-1103.110~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-azure-5.15 5.15.0-1110.119~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-gcp-5.15 5.15.0-1103.112~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-hwe-5.15 5.15.0-173.183~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-ibm-5.15 5.15.0-1097.100~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-lowlatency-hwe-5.15 5.15.0-173.183~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-oracle-5.15 5.15.0-1100.106~20.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux 5.15.0-173.183
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-aws 5.15.0-1103.110
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-aws-6.8 6.8.0-1051.54~22.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-azure 5.15.0-1109.118
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-gcp 5.15.0-1103.112
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-gcp-6.8 6.8.0-1053.56~22.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-gke 5.15.0-1099.105
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-ibm 5.15.0-1097.100
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-ibm-6.8 6.8.0-1050.50~22.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-oracle 5.15.0-1100.106
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux 6.8.0-107.107
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-aws 6.8.0-1051.54
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-azure 6.8.0-1052.58
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-gcp 6.8.0-1053.56
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-ibm 6.8.0-1050.50
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-oracle 6.8.0-1049.50
Ubuntu · Pro 25.10 Pro:25.10 linux 6.17.0-20.20

Vulnerabilities 8

  • Critical 9.8
    CVE-2024-56640

    net/smc: fix LGR and link use-after-free issue

    In the Linux kernel, the following vulnerability has been resolved: net/smc: fix LGR and link use-after-free issue We encountered a LGR/link use-after-free issue, which manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21780

    drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23111 Public exploit

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23268

    apparmor: fix unprivileged local user can do privileged policy management

    In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confuse…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-23269

    apparmor: validate DFA start states are in bounds in unpack_pdb

    In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2024-56581

    btrfs: ref-verify: fix use-after-free after invalid ref action

    In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry'…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2024-56593

    wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' valu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-21704

    usb: cdc-acm: Check control transfer buffer size before access

    In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2024-56581
  • report
    https://ubuntu.com/security/CVE-2024-56593
  • report
    https://ubuntu.com/security/CVE-2024-56640
  • report
    https://ubuntu.com/security/CVE-2025-21704
  • report
    https://ubuntu.com/security/CVE-2025-21780
  • report
    https://ubuntu.com/security/CVE-2026-23111
  • report
    https://ubuntu.com/security/CVE-2026-23268
  • report
    https://ubuntu.com/security/CVE-2026-23269