Summary
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request
ipc_msg_send_request() waits for a generic netlink reply using an
ipc_msg_table_entry on the stack.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix use-after-free of share_conf in compound request
smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without
validating tcon->t_state.
In the Linux kernel, the following vulnerability has been
resolved: netfilter: nf_conntrack_h323: check for zero length in
DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit
length from the packet, then decrements it by 1 to skip the protocol
discriminator byte before passing it to DecodeH323_UserInformation().
In the Linux kernel, the following vulnerability has been
resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0
replay cache uses a fixed 112-byte inline buffer
(rp_ibuf.
In the Linux kernel, the following vulnerability has been
resolved: media: dvb-net: fix OOB access in ULE extension header tables The
ule_mandatory_ext_handlers.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container.)(CVE-2026-31431)
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in
smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 'ksmbd: add
support for read compound'), response buffer management was changed to use
dynamic iov array.
In the Linux kernel, the following vulnerability has been
resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When
a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit()
unconditionally overwrites urb->number_of_packets from the network PDU.
This value is subsequently used as the loop bound in usbip_recv_iso() and
usbip_pad_iso() to iterate over urb->iso_frame_desc.
In the Linux kernel, the following vulnerability has been
resolved: rxrpc: reject undecryptable rxkad response tickets
rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses
the buffer as plaintext without checking whether crypto_skcipher_decrypt()
succeeded.
In the Linux kernel, the following vulnerability has been
resolved: batman-adv: hold claim backbone gateways by reference
batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway's last reference while readers still follow the pointer.
In the Linux kernel, the following vulnerability has been
resolved: batman-adv: reject oversized global TT response buffers
batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
smb2_get_ea() applies 4-byte alignment padding via memset() after writing
each EA entry.
In the Linux kernel, the following vulnerability has been
resolved: net/x25: Fix potential double free of skb When alloc_skb fails in
x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1
(error).
In the Linux kernel, the following vulnerability has been
resolved: ip6_tunnel: clear skb2->cb.
In the Linux kernel, the following vulnerability has been
resolved: ipv6: icmp: clear skb2->cb.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
smb_direct_prepare_negotiation() casts an unsigned __u32 value from
sp->max_recv_size and req->preferred_send_size to a signed int before
computing min_t(int, ...).
In the Linux kernel, the following vulnerability has been
resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to
decide how much data to write for each node.
In the Linux kernel, the following vulnerability has been
resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the
key, verify that the key material would fit into a fixed-size buffer in
process_auth_done() and generally has a sane length.
In the Linux kernel, the following vulnerability has been
resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill
ioam6_fill_trace_data() stores the schema contribution to the trace length
in a u8.
In the Linux kernel, the following vulnerability has been
resolved: libceph: prevent potential out-of-bounds reads in
process_message_header() If the message frame is (maliciously) corrupted in
a way that the length of the control segment ends up being less than the
size of the message header or a different frame is made to look like a
message frame, out-of-bounds reads may ensue in process_message_header().
Perform an explicit bounds check before decoding the message header.)(CVE-2026-43406).
In the Linux kernel, the following vulnerability has been
resolved: libceph: Fix potential out-of-bounds access in
ceph_handle_auth_reply() This patch fixes an out-of-bounds access in
ceph_handle_auth_reply() that can be triggered by a message of type
CEPH_MSG_AUTH_REPLY.
In the Linux kernel, the following vulnerability has been
resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG
requests can return EBUSY.
In the Linux kernel, the following vulnerability has been
resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back.
In the Linux kernel, the following vulnerability has been
resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet
gets a temporary failure during processing, it may end up in a partially
decrypted
Fixed packages 34
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux | 4.4.0-284.318 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws | 4.4.0-1195.210 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws-hwe | 4.15.0-1195.208~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-azure | 4.15.0-1205.220~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-gcp | 4.15.0-1188.205~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-hwe | 4.15.0-254.266~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux | 4.15.0-254.266 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | 4.15.0-1195.208 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-4.15 | 4.15.0-1205.220 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-4.15 | 4.15.0-1188.205 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-hwe-5.4 | 5.4.0-234.254~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle | 4.15.0-1158.169 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux | 5.4.0-234.254 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux | 5.15.0-187.197 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws | 5.15.0-1113.120 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws-6.8 | 6.8.0-1061.64~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-azure | 5.15.0-1118.127 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gcp | 5.15.0-1114.124 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gcp-6.8 | 6.8.0-1064.72~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gke | 5.15.0-1110.116 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-hwe-6.8 | 6.8.0-136.136~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-ibm | 5.15.0-1107.111 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-ibm-6.8 | 6.8.0-1061.62~22.04.1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux | 6.8.0-136.136 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-aws | 6.8.0-1061.64 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-azure | 6.8.0-1063.71 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-gcp | 6.8.0-1064.72 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-gke | 6.8.0-1059.67 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-ibm | 6.8.0-1061.62 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-oracle | 6.8.0-1058.61 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | linux | 7.0.0-28.28 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | linux-aws | 7.0.0-1009.9 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | linux-azure | 7.0.0-1010.10 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | linux-gcp | 7.0.0-1008.8 |
Vulnerabilities 34
-
High 7.8
crypto: algif_aead - Revert to operating out-of-place
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif…
KEV May 1, 2026 -
Critical 9.8
ksmbd: ipc: fix use-after-free in ipc_msg_send_request
In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_…
-
Critical 9.8
ksmbd: fix use-after-free of share_conf in compound request
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of share_conf in compound request smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without validating tcon->t_state. ksmbd_tree_conn_lookup() checks t_st…
-
Critical 9.8CVE-2026-31402 Public exploit
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size…
-
Critical 9.8
media: dvb-net: fix OOB access in ULE extension header tables
In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 eleme…
-
Critical 9.8
ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was change…
-
Critical 9.8
usbip: validate number_of_packets in usbip_pack_ret_submit()
In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets fro…
-
Critical 9.8
rxrpc: reject undecryptable rxkad response tickets
In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_d…
-
Critical 9.8
batman-adv: hold claim backbone gateways by reference
In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer. T…
-
Critical 9.8
batman-adv: reject oversized global TT response buffers
In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote origina…
-
Critical 9.8
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is perfo…
-
Critical 9.8
net/x25: Fix potential double free of skb
In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error). This error propagates back through the call chai…
-
Critical 9.8
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…
-
Critical 9.8
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an I…
-
Critical 9.8
ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed …
-
Critical 9.8
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide how much data to write for each node. It trusts …
-
Critical 9.8
libceph: define and enforce CEPH_MAX_KEY_LEN
In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The…
-
Critical 9.8
net/ipv6: ioam6: prevent schema length wraparound in trace fill
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema …
-
Critical 9.8
crypto: pcrypt - Fix handling of MAY_BACKLOG requests
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.
-
Critical 9.8CVE-2026-43501 Public exploit
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, t…
-
Critical 9.8
rxrpc: Fix re-decryption of RESPONSE packets
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then get requeued for a retry.…
-
Critical 9.8
nvmet-tcp: fix race between ICReq handling and queue teardown
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so withou…
-
Critical 9.8
smb: client: validate dacloffset before building DACL pointers
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd …
-
Critical 9.1
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…
-
Critical 9.1
libceph: prevent potential out-of-bounds reads in process_message_header()
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_header() If the message frame is (maliciously) corrupted in a way that the length of the control segment ends up being less t…
-
Critical 9.1
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes an out-of-bounds access in ceph_handle_auth_reply() that can be triggered by a message of type CEPH_MS…
-
Critical 9.1
RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used…
-
Critical 9.1
libceph: Fix slab-out-of-bounds access in auth message processing
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds access in auth message processing If a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY contains a positive value in its result field, it is treated…
-
Critical 9.1
smb/client: fix out-of-bounds read in symlink_data()
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for …
-
High 7.8
procfs: fix missing RCU protection when reading real_parent in do_task_stat()
In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which lea…
-
High 7.8
io-wq: check that the predecessor is hashed in io_wq_remove_pending()
In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled work was the tail of its hash bucket. When doing …
-
High 7.8
net/sched: act_ct: Only release RCU read lock after ct_ft
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read c…
-
High 7.8
Out-of-bounds read in Ubuntu Linux AppArmor notification handling
Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged loca…
-
High 7.5
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers n…
References
-
report
https://ubuntu.com/security/CVE-2025-68263
-
report
https://ubuntu.com/security/CVE-2026-23428
-
report
https://ubuntu.com/security/CVE-2026-23455
-
report
https://ubuntu.com/security/CVE-2026-31402
-
report
https://ubuntu.com/security/CVE-2026-31405
-
report
https://ubuntu.com/security/CVE-2026-31431
-
report
https://ubuntu.com/security/CVE-2026-31478
-
report
https://ubuntu.com/security/CVE-2026-31607
-
report
https://ubuntu.com/security/CVE-2026-31637
-
report
https://ubuntu.com/security/CVE-2026-31657
-
report
https://ubuntu.com/security/CVE-2026-31659
-
report
https://ubuntu.com/security/CVE-2026-31705
-
report
https://ubuntu.com/security/CVE-2026-43011
-
report
https://ubuntu.com/security/CVE-2026-43037
-
report
https://ubuntu.com/security/CVE-2026-43038
-
report
https://ubuntu.com/security/CVE-2026-43185
-
report
https://ubuntu.com/security/CVE-2026-43186
-
report
https://ubuntu.com/security/CVE-2026-43304
-
report
https://ubuntu.com/security/CVE-2026-43341
-
report
https://ubuntu.com/security/CVE-2026-43406
-
report
https://ubuntu.com/security/CVE-2026-43407
-
report
https://ubuntu.com/security/CVE-2026-43493
-
report
https://ubuntu.com/security/CVE-2026-43501
-
report
https://ubuntu.com/security/CVE-2026-45988
-
report
https://ubuntu.com/security/CVE-2026-46043
-
report
https://ubuntu.com/security/CVE-2026-46119
-
report
https://ubuntu.com/security/CVE-2026-46135
-
report
https://ubuntu.com/security/CVE-2026-46185
-
report
https://ubuntu.com/security/CVE-2026-46195
-
report
https://ubuntu.com/security/CVE-2026-46259
-
report
https://ubuntu.com/security/CVE-2026-46274
-
report
https://ubuntu.com/security/CVE-2026-46304
-
report
https://ubuntu.com/security/CVE-2026-46319
-
report
https://ubuntu.com/security/CVE-2026-47333