Threats affecting pkg:deb/ubuntu/linux

CVE-2026-98389 is a vulnerability in the Linux kernel's AMDGPU driver where the gfx switch_power_profile function is invoked during GPU reset before the reset completes. This improper timing causes an assertion error due to register access without releasing the GPU reset semaphore. The issue has been resolved by skipping the switch_power_profile call during GPU reset.

A vulnerability in the Linux kernel's s390/crypto module was fixed by correcting the handling of return codes from skcipher_walk_virt() in the aes_s390 implementation. Improper checking of these return codes before processing loops could lead to undefined behavior or access to uninitialized memory. This issue affects specific versions of the linux-hwe-edge kernel and has a low severity rating.

A vulnerability in the Linux kernel's qla2xxx SCSI driver was fixed by changing how the QLAFX00 request ring slot is cleared. The issue involved using a plain memset() on device I/O memory, which can cause synchronous external aborts on architectures like ARM64. The fix replaces memset() with memset_io() to properly clear the I/O memory region.

CVE-2026-98419 is a high-severity vulnerability in the Linux kernel's drop_monitor component. It involves an out-of-bounds write in the reset_per_cpu_data() function caused by incorrect buffer size calculation and memory zeroing. This flaw can lead to corruption of kernel memory structures.

CVE-2026-98401 is a vulnerability in the Linux kernel's iptunnel code where a stale transport header offset after tunnel decapsulation can cause a kernel crash. The issue arises when an encapsulated packet carrying GSO metadata is decapsulated, but the transport header offset is not properly reset, leading to an invalid memory access during packet processing. This can cause a kernel page fault and system instability. The vulnerability specifically affects scenarios involving GSO packets forwarded at layer 2 by a bridge or HSR. The fix involves clearing the transport header offset in the GRO cell processing for all tunnel drivers.

CVE-2026-98388 is a Linux kernel vulnerability involving the improper ordering of the do_close_on_exec() function call relative to the exec_update_lock. The issue could cause blocking or deadlock scenarios, especially with hung filesystems or FUSE filesystems that inspect the calling process. The vulnerability has been addressed by moving the do_close_on_exec() call before acquiring the exec_update_lock, preventing potential deadlocks.

A vulnerability in the Linux kernel's xen/netfront driver was resolved that involved improper handling of received packets with Ethernet headers shorter than expected. The issue caused a kernel bug due to insufficient validation of packet length before processing the Ethernet header, potentially leading to kernel crashes.

A vulnerability in the Linux kernel's BPF subsystem involving percpu array inner map replacement has been resolved. The issue arises because the original map_meta_equal function does not compare max_entries, allowing an inner map with fewer max_entries to bypass checks. This can lead to out-of-bounds access during lookups. The fix involves pointing percpu_array_map_ops.map_meta_equal to a function that enforces max_entries equality and adding a selftest to prevent replacement with differently-sized inner maps.

A vulnerability in the Linux kernel's VLAN tag insertion code could cause uninitialized memory to be transmitted when certain conditions are met, specifically when the MAC header is not present in __vlan_insert_inner_tag(). This occurs because the function assumes the MAC header is present and rewrites bytes without verifying this, leading to potential leakage of kernel memory contents. The issue has been resolved by requiring the MAC header to be present before rewriting. The vulnerability affects specific Linux kernel versions listed and is rated medium severity.

A use-after-free vulnerability in the Linux kernel's BPF subsystem was resolved. The issue occurs because the bpf_link_prime() function inserts a link before it is fully settled, leading to a dangling reference if anon_inode_getfile() fails. This causes the iterator to access freed memory, potentially triggering a kernel panic.

A vulnerability in the Linux kernel's netfilter ip6t_rpfilter module allows an unprivileged user to trigger a NULL pointer dereference via IPv6 reverse-path filtering. This occurs because ip6_route_lookup() can return a route with a NULL inet6_dev pointer, leading to a kernel crash (general protection fault). The issue arises when lowering an external nexthop device's MTU below IPV6_MIN_MTU, which tears down its inet6_dev while routes remain in the forwarding information base (FIB).

A vulnerability in the Linux kernel's network scheduler (net/sched) was resolved that involved improper handling of IDR error pointers during action deletion in the tcf_action_delete() function. This flaw could lead to a kernel panic due to a null pointer dereference when tcf_idr_delete_index() misinterprets an error pointer as a valid action. The issue was identified through kernel address sanitizer (KASAN) reports and reproduced using hardware execution breakpoints. The fix involves rejecting error pointers and returning an error code instead of dereferencing invalid memory.

A vulnerability in the Linux kernel's veth driver involves improper management of XDP program pointers during channel resizing in the veth_set_channels() function. This flaw can lead to use-after-free conditions where freed XDP programs may be executed again, causing kernel panics and fatal exceptions in interrupt context.

A vulnerability in the Linux kernel's BPF subsystem allows programs bound to specific network devices to be incorrectly matched to other devices. This can cause kernel crashes due to invalid memory accesses when running certain BPF programs on mismatched network devices. The issue arises from improper handling of device-bound BPF programs, leading to potential kernel panics and general protection faults.

A vulnerability in the Linux kernel related to the BPF subsystem has been resolved. Specifically, LWT_SEG6LOCAL programs could combine bpf_lwt_seg6_adjust_srh() and bpf_skb_pull_data() helpers in a way that leads to a dangling pointer and unsafe memory writes. The kernel now disallows the use of bpf_skb_pull_data() in LWT_SEG6LOCAL programs to prevent this unsafe condition. Other LWT program types remain unaffected in this regard.

A vulnerability in the Linux kernel's BPF subsystem was fixed to address an out-of-bounds read of the sk_protocol field in the bpf_sock_destroy() function. The issue arises because sk_protocol resides in struct sock, not struct sock_common, and certain socket states passed to bpf_sock_destroy() cause the code to read beyond the intended memory region. This flaw was corrected by ensuring sk_protocol is only checked on full socket structures, aligning with how tcp_abort() handles specific socket states.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary display drivers; - Compressed RAM block device driver; - GPIO subsystem; - GPU drivers; - HID subsystem; - I2C subsystem; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Mouse) drivers; - Multiple devices driver; - Media drivers; - Fastrpc Driver; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - Texas Instruments network drivers; - NVMEM (Non Volatile Memory) drivers; - Parport drivers; - SCSI subsystem; - SLIMbus drivers; - NVIDIA Tegra SoC drivers; - SPI subsystem; - Trusted Execution Environment drivers; - Thunderbolt and USB4 drivers; - TTY drivers; - USB Device Class drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Dual Role (OTG-ready) Controller drivers; - USB Serial drivers; - USB Type-C support driver; - USB Type-C Port Controller Manager driver; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - Framebuffer layer; - Ext4 file system; - FUSE (File system in Userspace); - File systems infrastructure; - SMB network file system; - Mellanox drivers; - Network traffic control; - Bluetooth subsystem; - IPv4 networking; - Netfilter; - IPv6 networking; - Network sockets; - XFRM subsystem; - IPC subsystem; - Signal handling mechanism; - Memory management; - 6LoWPAN network protocol; - IEEE 802 network protocols; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Networking core; - Devlink API; - Ethtool driver; - Handshake API; - HSR network protocol; - IEEE802154.4 network protocol; - IUCV driver; - L2TP protocol; - MAC80211 subsystem; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NetLabel subsystem; - NFC subsystem; - Open vSwitch; - Qualcomm IPC Router (QRTR); - RDS protocol; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - VMware vSockets driver; - Wireless networking; - ALSA framework; - Simple audio multiplexer codec driver; - Wolfson Microelectronics audio codecs; - KVM subsystem; (CVE-2025-68296, CVE-2025-68768, CVE-2026-23346, CVE-2026-31663, CVE-2026-43116, CVE-2026-43219, CVE-2026-43240, CVE-2026-43303, CVE-2026-43311, CVE-2026-43331, CVE-2026-45850, CVE-2026-45930, CVE-2026-46203, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-52908, CVE-2026-52910, CVE-2026-52913, CVE-2026-52917, CVE-2026-52923, CVE-2026-52927, CVE-2026-52929, CVE-2026-52930, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939, CVE-2026-52942, CVE-2026-52943, CVE-2026-52944, CVE-2026-52947, CVE-2026-52948, CVE-2026-53080, CVE-2026-53132, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53140, CVE-2026-53143, CVE-2026-53144, CVE-2026-53146, CVE-2026-53147, CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53154, CVE-2026-53156, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160, CVE-2026-53161, CVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53182, CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53190, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53198, CVE-2026-53199, CVE-2026-53202, CVE-2026-53205, CVE-2026-53208, CVE-2026-53209, CVE-2026-53210, CVE-2026-53213, CVE-2026-53214, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53220, CVE-2026-53223, CVE-2026-53227, CVE-2026-53229, CVE-2026-53230, CVE-2026-53232, CVE-2026-53236, CVE-2026-53237, CVE-2026-53238, CVE-2026-53239, CVE-2026-53242, CVE-2026-53245, CVE-2026-53249, CVE-2026-53251, CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53261, CVE-2026-53262, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53273, CVE-2026-53274, CVE-2026-53275, CVE-2026-53329, CVE-2026-53331, CVE-2026-53332, CVE-2026-53336, CVE-2026-53337, CVE-2026-53339, CVE-2026-53343, CVE-2026-53345, CVE-2026-53347, CVE-2026-53349, CVE-2026-53350, CVE-2026-53352, CVE-2026-53353, CVE-2026-53356, CVE-2026-53358, CVE-2026-63867, CVE-2026-63868, CVE-2026-63869, CVE-2026-63870, CVE-2026-63871, CVE-2026-63875, CVE-2026-63876, CVE-2026-63877, CVE-2026-63881, CVE-2026-63882, CVE-2026-63883, CVE-2026-63884, CVE-2026-63889, CVE-2026-63890, CVE-2026-63891, CVE-2026-63892, CVE-2026-63893, CVE-2026-63895, CVE-2026-63896, CVE-2026-63897, CVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63906, CVE-2026-63908, CVE-2026-63909, CVE-2026-63913, CVE-2026-63914, CVE-202

A vulnerability in the Linux kernel's hugetlb memory management subsystem was resolved. The issue involved incorrect advancement of destination addresses during the mremap() operation when skipping page tables, which could lead to kernel panic on x86-64 systems. The flaw was fixed by ensuring the destination address advances by the same amount as the source address. Multiple specific Linux kernel versions are affected.

A use-after-free vulnerability in the Linux kernel's TCP implementation (tcp_send_synack) was resolved. The flaw involves a dangling pointer (retransmit_skb_hint) that can be manipulated by an unprivileged TCP Fast Open client using a crafted ICMP fragmentation-needed message, potentially causing kernel memory corruption. This issue affects specific Linux kernel versions used in various Ubuntu HWE edge releases.