Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Ethernet bonding driver;
- Network drivers;
- F2FS file system;
- Tracing infrastructure;
- Networking core;
- IUCV driver;
- RxRPC session sockets;
(CVE-2022-49149, CVE-2022-49170, CVE-2023-52784, CVE-2024-53210,
CVE-2024-56616, CVE-2024-56763, CVE-2026-43456, CVE-2026-52910,
CVE-2026-53086)
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-azure | 4.15.0-1209.224~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws-hwe | 4.15.0-1199.212~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-azure | 4.15.0-1209.224~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-gcp | 4.15.0-1192.209~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-hwe | 4.15.0-262.274~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-oracle | 4.15.0-1161.172~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux | 4.15.0-262.274 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | 4.15.0-1199.212 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-4.15 | 4.15.0-1209.224 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-4.15 | 4.15.0-1192.209 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-kvm | 4.15.0-1181.186 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle | 4.15.0-1161.172 |
| Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS | linux-aws-fips | 4.15.0-2137.143 |
| Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS | linux-azure-fips | 4.15.0-2117.123 |
| Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS | linux-fips | 4.15.0-1154.166 |
| Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS | linux-gcp-fips | 4.15.0-2100.106 |
Vulnerabilities 9
-
Critical 9.8
rxrpc: Fix call timer start racing with call destruction
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call timer start racing with call destruction The rxrpc_call struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet i…
-
Critical 9.8
net: bcmgenet: fix racing timeout handler
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions wit…
-
High 7.8
f2fs: fix to do sanity check on curseg->alloc_type
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on curseg->alloc_type As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215657 - Overview UBSAN: array-index-out-of-bounds in fs/f2…
-
High 7.8
bonding: fix type confusion in bond_setup_by_slave()
In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bond_setup_by_slave() kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbu…
-
High 7.8CVE-2026-52910 Public exploit
bpf: Free reuseport cBPF prog after RCU grace period.
In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below with a repro. [0] The repro sets up a UDP reuseport group with a cBPF prog and replaces it with a new…
-
Medium 5.5
s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
In the Linux kernel, the following vulnerability has been resolved: s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() Passing MSG_PEEK flag to skb_recv_datagram() increments skb refcount (skb->users) and iucv_sock_recvmsg() does not decrement skb…
-
Unscored —
bonding: stop the device in bond_setup_by_slave()
In the Linux kernel, the following vulnerability has been resolved: bonding: stop the device in bond_setup_by_slave() Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today. In the fo…
-
Unscored —
drm/dp_mst: Fix MST sideband message body length check
In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix MST sideband message body length check Fix the MST sideband message body length check, which must be at least 1 byte accounting for the message body CRC (aka message data CRC)…
-
Unscored —
tracing: Prevent bad count for tracing_cpumask_write
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it.
References
-
report
https://ubuntu.com/security/CVE-2022-49149
-
report
https://ubuntu.com/security/CVE-2022-49170
-
report
https://ubuntu.com/security/CVE-2023-52784
-
report
https://ubuntu.com/security/CVE-2024-53210
-
report
https://ubuntu.com/security/CVE-2024-56616
-
report
https://ubuntu.com/security/CVE-2024-56763
-
report
https://ubuntu.com/security/CVE-2026-43456
-
report
https://ubuntu.com/security/CVE-2026-52910
-
report
https://ubuntu.com/security/CVE-2026-53086