Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Ethernet bonding driver;
- Network drivers;
- F2FS file system;
- Tracing infrastructure;
- io_uring subsystem;
- Networking core;
- IUCV driver;
- RxRPC session sockets;
(CVE-2022-49149, CVE-2022-49170, CVE-2022-49182, CVE-2022-49201,
CVE-2024-53187, CVE-2024-53210, CVE-2024-56763, CVE-2026-43456,
CVE-2026-52910)
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-5.4 | 5.4.0-1170.176~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-5.4 | 5.4.0-1168.178~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-hwe-5.4 | 5.4.0-242.262~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle-5.4 | 5.4.0-1163.173~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-raspi-5.4 | 5.4.0-1148.161~18.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux | 5.4.0-242.262 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws | 5.4.0-1165.176 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-azure | 5.4.0-1170.176 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp | 5.4.0-1168.178 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-iot | 5.4.0-1069.72 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-kvm | 5.4.0-1152.161 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-oracle | 5.4.0-1163.173 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-raspi | 5.4.0-1148.161 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-xilinx-zynqmp | 5.4.0-1083.87 |
| Ubuntu · Pro FIPS-updates 20.04 LTS Pro:FIPS-updates:20.04:LTS | linux-fips | 5.4.0-1139.149 |
| Ubuntu · Pro FIPS-updates 20.04 LTS Pro:FIPS-updates:20.04:LTS | linux-gcp-fips | 5.4.0-1168.178+fips1 |
Vulnerabilities 9
-
Critical 9.8
rxrpc: Fix call timer start racing with call destruction
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call timer start racing with call destruction The rxrpc_call struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet i…
-
Critical 9.8
ibmvnic: fix race between xmit and reset
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: fix race between xmit and reset There is a race between reset and the transmit paths that can lead to ibmvnic_xmit() accessing an scrq after it has been freed in the reset path. It c…
-
High 7.8
f2fs: fix to do sanity check on curseg->alloc_type
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on curseg->alloc_type As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215657 - Overview UBSAN: array-index-out-of-bounds in fs/f2…
-
High 7.8
net: hns3: add vlan list lock to protect vlan list
In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in vf VLAN list as false. If the periodicity task is fr…
-
High 7.8
bonding: fix type confusion in bond_setup_by_slave()
In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bond_setup_by_slave() kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbu…
-
High 7.8CVE-2026-52910 Public exploit
bpf: Free reuseport cBPF prog after RCU grace period.
In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below with a repro. [0] The repro sets up a UDP reuseport group with a cBPF prog and replaces it with a new…
-
Medium 5.5
io_uring: check for overflows in io_pin_pages
In the Linux kernel, the following vulnerability has been resolved: io_uring: check for overflows in io_pin_pages WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 N…
-
Medium 5.5
s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
In the Linux kernel, the following vulnerability has been resolved: s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() Passing MSG_PEEK flag to skb_recv_datagram() increments skb refcount (skb->users) and iucv_sock_recvmsg() does not decrement skb…
-
Unscored —
tracing: Prevent bad count for tracing_cpumask_write
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it.
References
-
report
https://ubuntu.com/security/CVE-2022-49149
-
report
https://ubuntu.com/security/CVE-2022-49170
-
report
https://ubuntu.com/security/CVE-2022-49182
-
report
https://ubuntu.com/security/CVE-2022-49201
-
report
https://ubuntu.com/security/CVE-2024-53187
-
report
https://ubuntu.com/security/CVE-2024-53210
-
report
https://ubuntu.com/security/CVE-2024-56763
-
report
https://ubuntu.com/security/CVE-2026-43456
-
report
https://ubuntu.com/security/CVE-2026-52910