Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- NVIDIA Tegra memory controller driver;
- File systems infrastructure;
- Network file system (NFS) server daemon;
- OCFS2 file system;
- B.A.T.M.A.N. meshing protocol;
- Netfilter;
- SCTP protocol;
(CVE-2022-50401, CVE-2026-43071, CVE-2026-52914, CVE-2026-53002,
CVE-2026-53043, CVE-2026-53045, CVE-2026-53224, CVE-2026-53309)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws | 4.4.0-1196.211 |
Vulnerabilities 8
-
Critical 9.8
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and t…
-
Critical 9.8
batman-adv: fix fragment reassembly length accounting
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accountin…
-
Critical 9.8
netfilter: conntrack: remove sprintf usage
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer…
-
Critical 9.8
memory: tegra124-emc: Fix dll_change check
In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_change check The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check.
-
Critical 9.8
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr…
-
Critical 9.1
dcache: Limit the minimal number of bucket to two
In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1': BUG: unable to handle page fault for address: ffff888b30b7…
-
Critical 9.1
ocfs2/dlm: validate qr_numregions in dlm_match_regions()
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION…
-
Critical 9.1
sctp: validate embedded INIT chunk and address list lengths in cookie
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but di…
References
-
report
https://ubuntu.com/security/CVE-2022-50401
-
report
https://ubuntu.com/security/CVE-2026-43071
-
report
https://ubuntu.com/security/CVE-2026-52914
-
report
https://ubuntu.com/security/CVE-2026-53002
-
report
https://ubuntu.com/security/CVE-2026-53043
-
report
https://ubuntu.com/security/CVE-2026-53045
-
report
https://ubuntu.com/security/CVE-2026-53224
-
report
https://ubuntu.com/security/CVE-2026-53309