Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- File systems infrastructure;
- OCFS2 file system;
- B.A.T.M.A.N. meshing protocol;
- SCTP protocol;
- TIPC protocol;
(CVE-2026-43071, CVE-2026-52914, CVE-2026-52993, CVE-2026-53043,
CVE-2026-53224, CVE-2026-53246, CVE-2026-53309)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-azure | 4.15.0-1206.221~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-azure | 4.15.0-1206.221~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-4.15 | 4.15.0-1206.221 |
| Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS | linux-azure-fips | 4.15.0-2114.120 |
Vulnerabilities 7
-
Critical 9.8
batman-adv: fix fragment reassembly length accounting
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accountin…
-
Critical 9.8CVE-2026-52993 Public exploit
tipc: fix double-free in tipc_buf_append()
In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a point…
-
Critical 9.8
sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is pars…
-
Critical 9.8
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr…
-
Critical 9.1
dcache: Limit the minimal number of bucket to two
In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1': BUG: unable to handle page fault for address: ffff888b30b7…
-
Critical 9.1
ocfs2/dlm: validate qr_numregions in dlm_match_regions()
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION…
-
Critical 9.1
sctp: validate embedded INIT chunk and address list lengths in cookie
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but di…
References
-
report
https://ubuntu.com/security/CVE-2026-43071
-
report
https://ubuntu.com/security/CVE-2026-52914
-
report
https://ubuntu.com/security/CVE-2026-52993
-
report
https://ubuntu.com/security/CVE-2026-53043
-
report
https://ubuntu.com/security/CVE-2026-53224
-
report
https://ubuntu.com/security/CVE-2026-53246
-
report
https://ubuntu.com/security/CVE-2026-53309