{ "summary": { "snap": { "added": [], "removed": [], "diff": [ "core22", "snapd" ] }, "deb": { "added": [ "linux-headers-5.15.0-191", "linux-headers-5.15.0-191-generic-lpae", "linux-image-5.15.0-191-generic-lpae", "linux-modules-5.15.0-191-generic-lpae" ], "removed": [ "linux-headers-5.15.0-190", "linux-headers-5.15.0-190-generic-lpae", "linux-image-5.15.0-190-generic-lpae", "linux-modules-5.15.0-190-generic-lpae" ], "diff": [ "bind9-dnsutils", "bind9-host", "bind9-libs:armhf", "bsdextrautils", "bsdutils", "coreutils", "cpio", "diffutils", "eject", "fdisk", "libattr1:armhf", "libblkid1:armhf", "libbz2-1.0:armhf", "libc-bin", "libc6:armhf", "libevent-core-2.1-7:armhf", "libfdisk1:armhf", "libgcrypt20:armhf", "libmount1:armhf", "libncurses6:armhf", "libncursesw6:armhf", "libperl5.34:armhf", "libpython3.10:armhf", "libpython3.10-minimal:armhf", "libpython3.10-stdlib:armhf", "libsmartcols1:armhf", "libssh-4:armhf", "libtinfo6:armhf", "libuuid1:armhf", "linux-generic-lpae", "linux-headers-generic-lpae", "linux-image-generic-lpae", "locales", "mount", "ncurses-base", "ncurses-bin", "ncurses-term", "openssh-client", "openssh-server", "openssh-sftp-server", "perl", "perl-base", "perl-modules-5.34", "python3-pyasn1", "python3.10", "python3.10-minimal", "util-linux", "uuid-runtime" ] } }, "diff": { "deb": [ { "name": "bind9-dnsutils", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.5", "version": "1:9.18.39-0ubuntu0.22.04.5" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.6", "version": "1:9.18.39-0ubuntu0.22.04.6" }, "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3", " both present", " - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could", " find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,", " lib/dns/resolver.c, lib/ns/query.c.", " - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname", " mismatch in", " bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,", " bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,", " bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests", " /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_", " runtime_check.py.", " - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,", " bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/", " system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-13204", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 27 Aug 2026 10:11:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-host", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.5", "version": "1:9.18.39-0ubuntu0.22.04.5" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.6", "version": "1:9.18.39-0ubuntu0.22.04.6" }, "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3", " both present", " - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could", " find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,", " lib/dns/resolver.c, lib/ns/query.c.", " - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname", " mismatch in", " bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,", " bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,", " bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests", " /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_", " runtime_check.py.", " - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,", " bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/", " system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-13204", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 27 Aug 2026 10:11:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-libs:armhf", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.5", "version": "1:9.18.39-0ubuntu0.22.04.5" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.6", "version": "1:9.18.39-0ubuntu0.22.04.6" }, "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13204", "url": "https://ubuntu.com/security/CVE-2026-13204", "cve_description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3", " both present", " - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could", " find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,", " lib/dns/resolver.c, lib/ns/query.c.", " - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname", " mismatch in", " bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,", " bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,", " bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests", " /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_", " runtime_check.py.", " - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,", " bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/", " system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-13204", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 27 Aug 2026 10:11:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bsdextrautils", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bsdutils", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "1:2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "1:2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "coreutils", "from_version": { "source_package_name": "coreutils", "source_package_version": "8.32-4.1ubuntu1.3", "version": "8.32-4.1ubuntu1.3" }, "to_version": { "source_package_name": "coreutils", "source_package_version": "8.32-4.1ubuntu1.4", "version": "8.32-4.1ubuntu1.4" }, "cves": [ { "cve": "CVE-2025-5278", "url": "https://ubuntu.com/security/CVE-2025-5278", "cve_description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "cve_priority": "low", "cve_public_date": "2025-05-27 21:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-5278", "url": "https://ubuntu.com/security/CVE-2025-5278", "cve_description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "cve_priority": "low", "cve_public_date": "2025-05-27 21:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: out-of-bounds read in sort", " - debian/patches/CVE-2025-5278.patch: sort: fix buffer under-read in", " src/sort.c, tests/local.mk, tests/misc/sort-field-limit.sh,", " Makefile.in.", " - CVE-2025-5278", "" ], "package": "coreutils", "version": "8.32-4.1ubuntu1.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 25 Aug 2026 11:12:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "cpio", "from_version": { "source_package_name": "cpio", "source_package_version": "2.13+dfsg-7ubuntu0.1", "version": "2.13+dfsg-7ubuntu0.1" }, "to_version": { "source_package_name": "cpio", "source_package_version": "2.13+dfsg-7ubuntu0.2", "version": "2.13+dfsg-7ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-66485", "url": "https://ubuntu.com/security/CVE-2026-66485", "cve_description": "GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66484", "url": "https://ubuntu.com/security/CVE-2026-66484", "cve_description": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66486", "url": "https://ubuntu.com/security/CVE-2026-66486", "cve_description": "GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2019-14866", "url": "https://ubuntu.com/security/CVE-2019-14866", "cve_description": "In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.", "cve_priority": "medium", "cve_public_date": "2020-01-07 17:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-66485", "url": "https://ubuntu.com/security/CVE-2026-66485", "cve_description": "GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66484", "url": "https://ubuntu.com/security/CVE-2026-66484", "cve_description": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66486", "url": "https://ubuntu.com/security/CVE-2026-66486", "cve_description": "GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2019-14866", "url": "https://ubuntu.com/security/CVE-2019-14866", "cve_description": "In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.", "cve_priority": "medium", "cve_public_date": "2020-01-07 17:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unbounded stack allocation", " - debian/patches/CVE-2026-66485.patch: Minor fixes in src/makepath.c,", " src/userspec.c.", " - CVE-2026-66485", " * SECURITY UPDATE: Hard link to file outside intended directory", " - debian/patches/CVE-2026-66484.patch: The --no-absolute-filenames option", " affects hard link targets too. in src/tar.c.", " - CVE-2026-66484", " * SECURITY UPDATE: Unescaped output", " - debian/patches/CVE-2026-66486.patch: Quote file names in error messages", " and in listings. in src/copyin.c, src/copyout.c, src/copypass.c,", " src/main.c, tests/CVE-2019-14866.at, tests/testsuite.", " - CVE-2026-66486", "" ], "package": "cpio", "version": "2.13+dfsg-7ubuntu0.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Isabel Garcia Contreras ", "date": "Tue, 18 Aug 2026 16:46:57 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "diffutils", "from_version": { "source_package_name": "diffutils", "source_package_version": "1:3.8-0ubuntu2", "version": "1:3.8-0ubuntu2" }, "to_version": { "source_package_name": "diffutils", "source_package_version": "1:3.8-0ubuntu2.1", "version": "1:3.8-0ubuntu2.1" }, "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Integer Overflow", " - debian/patches/CVE-2026-53910-1.patch: diff3: check for integer overflows", " when reading line numbers from diff in NEWS, THANKS, src/diff3.c.", " - debian/patches/CVE-2026-53910-2.patch: diff3: prevent overflow in line", " offsets in src/diff3.c.", " - CVE-2026-53910", "" ], "package": "diffutils", "version": "1:3.8-0ubuntu2.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 26 Aug 2026 14:17:15 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "eject", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "fdisk", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libattr1:armhf", "from_version": { "source_package_name": "attr", "source_package_version": "1:2.5.1-1build1", "version": "1:2.5.1-1build1" }, "to_version": { "source_package_name": "attr", "source_package_version": "1:2.5.1-1ubuntu0.1", "version": "1:2.5.1-1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Symlink Traversal", " - d/p/CVE-2026-54371-01-add-visibility-attribute-header.patch: Add", " visibility attribute header in include/Makemodule.am, include/visibility-", " hidden.h.", " - d/p/CVE-2026-54371-02-add-xattrat-syscall-wrappers.patch: Add xattrat", " syscall wrappers in configure.ac, include/Makemodule.am,", " include/xattrat.h, libmisc/Makemodule.am, libmisc/xattrat.c.", " - d/p/CVE-2026-54371-03-add-xattrat-syscall-backwards-compatibility-", " code.patch: Add xattrat syscall backwards compatibility code in", " include/Makemodule.am, include/xattrat_compat.h, libmisc/Makemodule.am,", " libmisc/getxattrat_compat.c, libmisc/listxattrat_compat.c, libmisc/proc-", " self-fd.c, libmisc/proc-self-fd.h, libmisc/removexattrat_compat.c,", " libmisc/setxattrat_compat.c.", " - d/p/CVE-2026-54371-04-rename-walk_tree-to-old_walk_tree.patch: Rename", " walk_tree to old_walk_tree in include/Makemodule.am,", " include/old_walk_tree.h, libmisc/Makemodule.am, libmisc/old_walk_tree.c,", " tools/getfattr.c.", " - d/p/CVE-2026-54371-05-add-the-new-walk_tree-helper.patch: Add the new", " walk_tree helper in include/Makemodule.am, include/walk_tree.h,", " libmisc/Makemodule.am, libmisc/walk_tree.c.", " - debian/patches/CVE-2026-54371-06-harden-getfattr.patch: harden getfattr in", " man/man1/getfattr.1, tools/getfattr.c, test/root/getfattr.test.", " - d/p/CVE-2026-54371-07-setfattr-multiple-restore-accesses-freed-", " buffer.patch: setfattr: multiple --restore accesses freed buffer in", " tools/setfattr.c.", " - d/p/CVE-2026-54371-08-setfattr-do-not-ignore-no-dereference-after-", " restore.patch: setfattr: Do not ignore --no-dereference after --restore in", " tools/setfattr.c.", " - d/p/CVE-2026-54371-09-add-openat2-syscall-wrapper.patch: Add openat2", " syscall wrapper in configure.ac, include/Makemodule.am, include/openat2.h,", " libmisc/Makemodule.am, libmisc/openat2.c.", " - debian/patches/CVE-2026-54371-10-harden-setfattr-restore.patch: harden", " setfattr --restore in configure.ac, man/man1/setfattr.1,", " test/Makemodule.am, tools/setfattr.c, test/restore.test.", " - CVE-2026-54371", "" ], "package": "attr", "version": "1:2.5.1-1ubuntu0.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Sun, 23 Aug 2026 21:42:23 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblkid1:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbz2-1.0:armhf", "from_version": { "source_package_name": "bzip2", "source_package_version": "1.0.8-5build1", "version": "1.0.8-5build1" }, "to_version": { "source_package_name": "bzip2", "source_package_version": "1.0.8-5ubuntu0.1", "version": "1.0.8-5ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-42250", "url": "https://ubuntu.com/security/CVE-2026-42250", "cve_description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "cve_priority": "low", "cve_public_date": "2026-05-28 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42250", "url": "https://ubuntu.com/security/CVE-2026-42250", "cve_description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "cve_priority": "low", "cve_public_date": "2026-05-28 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: out-of-bounds write", " - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not", " process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.", " - CVE-2026-42250", "" ], "package": "bzip2", "version": "1.0.8-5ubuntu0.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shishir Subedi ", "date": "Thu, 27 Aug 2026 09:51:50 +0545" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.14", "version": "2.35-0ubuntu3.14" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.15", "version": "2.35-0ubuntu3.15" }, "cves": [ { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.35-0ubuntu3.15", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:20:04 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6:armhf", "from_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.14", "version": "2.35-0ubuntu3.14" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.15", "version": "2.35-0ubuntu3.15" }, "cves": [ { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.35-0ubuntu3.15", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:20:04 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libevent-core-2.1-7:armhf", "from_version": { "source_package_name": "libevent", "source_package_version": "2.1.12-stable-1build3", "version": "2.1.12-stable-1build3" }, "to_version": { "source_package_name": "libevent", "source_package_version": "2.1.12-stable-1ubuntu0.1", "version": "2.1.12-stable-1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-63381", "url": "https://ubuntu.com/security/CVE-2026-63381", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63382", "url": "https://ubuntu.com/security/CVE-2026-63382", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63383", "url": "https://ubuntu.com/security/CVE-2026-63383", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63384", "url": "https://ubuntu.com/security/CVE-2026-63384", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63385", "url": "https://ubuntu.com/security/CVE-2026-63385", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-63381", "url": "https://ubuntu.com/security/CVE-2026-63381", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63382", "url": "https://ubuntu.com/security/CVE-2026-63382", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63383", "url": "https://ubuntu.com/security/CVE-2026-63383", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63384", "url": "https://ubuntu.com/security/CVE-2026-63384", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-63385", "url": "https://ubuntu.com/security/CVE-2026-63385", "cve_description": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: dangling pointer in buffer reference handling", " - debian/patches/CVE-2026-63381.patch: reset empty output buffer", " pointers and add regression coverage in buffer.c and", " test/regress_buffer.c.", " - CVE-2026-63381", " * SECURITY UPDATE: HTTP request smuggling in request body framing", " - debian/patches/CVE-2026-63382_1.patch: require strict CRLF chunk", " delimiters in http.c.", " - debian/patches/CVE-2026-63382_2.patch: validate transfer encodings", " and add tests in http-internal.h, http.c, and test/regress_http.c.", " - CVE-2026-63382", " * SECURITY UPDATE: out-of-bounds read during RPC tag decoding", " - debian/patches/CVE-2026-63383.patch: bound tag decoding to contiguous", " buffer data in event_tagging.c.", " - CVE-2026-63383", " * SECURITY UPDATE: integer overflow during RPC payload length decoding", " - debian/patches/CVE-2026-63384.patch: reject oversized RPC payload", " lengths in event_tagging.c and document the limit in", " include/event2/tag.h.", " - CVE-2026-63384", " * SECURITY UPDATE: HTTP header injection during folded header handling", " - debian/patches/CVE-2026-63385.patch: reject CR and LF in HTTP header", " values and update tests in http.c and test/regress_http.c.", " - CVE-2026-63385", "" ], "package": "libevent", "version": "2.1.12-stable-1ubuntu0.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Fri, 28 Aug 2026 16:44:15 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfdisk1:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgcrypt20:armhf", "from_version": { "source_package_name": "libgcrypt20", "source_package_version": "1.9.4-3ubuntu3.2", "version": "1.9.4-3ubuntu3.2" }, "to_version": { "source_package_name": "libgcrypt20", "source_package_version": "1.9.4-3ubuntu3.3", "version": "1.9.4-3ubuntu3.3" }, "cves": [ { "cve": "CVE-2024-2236", "url": "https://ubuntu.com/security/CVE-2024-2236", "cve_description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "cve_priority": "low", "cve_public_date": "2024-03-06 22:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2024-2236", "url": "https://ubuntu.com/security/CVE-2024-2236", "cve_description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "cve_priority": "low", "cve_public_date": "2024-03-06 22:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: timing-based side-channel flaw in RSA implementation", " - debian/patches/CVE-2024-2236-pre01.patch: rsa: Fix decoding of PKCS#1 v1.5", " and OAEP padding. in cipher/rsa-common.c, cipher/rsa.c, src/Makefile.am,", " src/const-time.c, src/const-time.h.", " - debian/patches/CVE-2024-2236-pre02.patch: const-time: Use ct_not_memequal,", " instead. Tested with AVR. in cipher/rsa-common.c, src/const-time.c,", " src/const-time.h.", " - debian/patches/CVE-2024-2236-pre03.patch: const-time: always avoid", " comparison operator for byte comparison in src/const-time.h.", " - debian/patches/CVE-2024-2236-pre04.patch: const-time: Add ct_memmov_cond,", " fix _gcry_mpih_set_cond. in mpi/mpih-const-time.c, src/const-time.c,", " src/const-time.h.", " - debian/patches/CVE-2024-2236-pre05.patch: Use single constant-time memory", " comparison implementation in cipher/bufhelp.h, src/const-time.c,", " src/const-time.h.", " - debian/patches/CVE-2024-2236-pre06.patch: cipher: Fix ElGamal decryption.", " in cipher/elgamal.c, cipher/rsa.c.", " - debian/patches/CVE-2024-2236-pre07.patch: rsa, elgamal: avoid logical not", " operator in constant-time code in cipher/elgamal.c, cipher/rsa-common.c,", " cipher/rsa.c, src/const-time.c, src/const-time.h.", " - debian/patches/CVE-2024-2236-pre08.patch: rsa: Use memmov_independently", " when unpadding. in cipher/rsa-common.c.", " - debian/patches/CVE-2024-2236-pre09.patch: const-time: prefix global", " symbols with _gcry_ in src/const-time.c, src/const-time.h.", " - debian/patches/CVE-2024-2236-pre10.patch: const-time: ct_memmov_cond:", " switch to use dual mask approach in src/const-time.c.", " - debian/patches/CVE-2024-2236-pre11.patch: mpih_set_cond: restore EM", " leakage mitigation in mpi/mpih-const-time.c.", " - debian/patches/CVE-2024-2236-pre12.patch: mpih-const-time: use global", " vzero/vone variable in mpi/mpih-const-time.c.", " - debian/patches/CVE-2024-2236-pre13.patch: mpih_cmp_ui: avoid unintentional", " conditional branch in mpi/mpi-internal.h, mpi/mpih-const-time.c.", " - debian/patches/CVE-2024-2236-pre14.patch: mpiutil: use global vone and", " vzero in mpi/mpiutil.c.", " - debian/patches/CVE-2024-2236-pre15.patch: const-time: add functions for", " generating masks from 0/1 input in mpi/mpi-internal.h, mpi/mpih-const-", " time.c, mpi/mpiutil.c, src/const-time.c, src/const-time.h.", " - debian/patches/CVE-2024-2236-pre16.patch: mpih-const-time: use constant-", " time comparisons conditional add/sub/abs in mpi/mpih-const-time.c.", " - debian/patches/CVE-2024-2236-pre17.patch: mpih_mod: avoid unintentional", " conditional branch in mpi/mpih-const-time.c.", " - debian/patches/CVE-2024-2236-pre18.patch: mpi: Fix for 64-bit for", " _gcry_mpih_cmp_ui. in mpi/mpih-const-time.c.", " - debian/patches/CVE-2024-2236-pre19.patch: addm/subm/mulm: fix case when", " destination is same MPI as divider in mpi/mpi-add.c, mpi/mpi-mul.c,", " tests/mpitests.c.", " - debian/patches/CVE-2024-2236-1.patch: rsa: Do not accept invalid PKCS#1.5", " padding when deciphering in cipher/rsa-common.c, src/const-time.h.", " - debian/patches/CVE-2024-2236-2.patch: rsa: Constant time blinding removal", " in cipher/rsa.c, configure.ac, mpi/Makefile.am, mpi/mpi-internal.h,", " mpi/mpi-mul-cs.c, mpi/mpi-mul.c, src/gcrypt-int.h.", " - debian/patches/CVE-2024-2236-3.patch: Constant time conversion of the", " message to the SEXP in cipher/rsa.c, src/const-time.c, src/const-time.h,", " src/sexp.c.", " - debian/patches/CVE-2024-2236-4.patch: rsa: Implement constant-time", " conversion of MPI to string in cipher/rsa-common.c.", " - debian/patches/CVE-2024-2236-5.patch: cipher: Use the constant time", " conversion also for OAEP in cipher/rsa-common.c, cipher/rsa.c.", " - debian/patches/CVE-2024-2236-6.patch: Implement implicit rejection for", " PKCS#1.5 decipher in cipher/pubkey-internal.h, cipher/pubkey-util.c,", " cipher/rsa-common.c, cipher/rsa.c, src/cipher.h, src/const-time.c,", " src/const-time.h, tests/pkcs1v2-v15c.h, tests/pkcs1v2.c.", " - debian/rules: build with --enable-marvin-workaround.", " - Thanks for Red Hat for the patches!", " - CVE-2024-2236", "" ], "package": "libgcrypt20", "version": "1.9.4-3ubuntu3.3", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 25 Aug 2026 08:56:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libmount1:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libncurses6:armhf", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.2", "version": "6.3-2ubuntu0.2" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.3", "version": "6.3-2ubuntu0.3" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.3-2ubuntu0.3", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:57 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libncursesw6:armhf", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.2", "version": "6.3-2ubuntu0.2" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.3", "version": "6.3-2ubuntu0.3" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.3-2ubuntu0.3", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:57 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libperl5.34:armhf", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.10:armhf", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.18", "version": "3.10.12-1~22.04.18" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:17 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.10-minimal:armhf", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.18", "version": "3.10.12-1~22.04.18" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:17 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.10-stdlib:armhf", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.18", "version": "3.10.12-1~22.04.18" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:17 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsmartcols1:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssh-4:armhf", "from_version": { "source_package_name": "libssh", "source_package_version": "0.9.6-2ubuntu0.22.04.7", "version": "0.9.6-2ubuntu0.22.04.7" }, "to_version": { "source_package_name": "libssh", "source_package_version": "0.9.6-2ubuntu0.22.04.8", "version": "0.9.6-2ubuntu0.22.04.8" }, "cves": [ { "cve": "CVE-2026-59843", "url": "https://ubuntu.com/security/CVE-2026-59843", "cve_description": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59845", "url": "https://ubuntu.com/security/CVE-2026-59845", "cve_description": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59846", "url": "https://ubuntu.com/security/CVE-2026-59846", "cve_description": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.", "cve_priority": "medium", "cve_public_date": "2026-07-21 13:17:00 UTC" }, { "cve": "CVE-2026-59847", "url": "https://ubuntu.com/security/CVE-2026-59847", "cve_description": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59848", "url": "https://ubuntu.com/security/CVE-2026-59848", "cve_description": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59850", "url": "https://ubuntu.com/security/CVE-2026-59850", "cve_description": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59843", "url": "https://ubuntu.com/security/CVE-2026-59843", "cve_description": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59845", "url": "https://ubuntu.com/security/CVE-2026-59845", "cve_description": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59846", "url": "https://ubuntu.com/security/CVE-2026-59846", "cve_description": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.", "cve_priority": "medium", "cve_public_date": "2026-07-21 13:17:00 UTC" }, { "cve": "CVE-2026-59847", "url": "https://ubuntu.com/security/CVE-2026-59847", "cve_description": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59848", "url": "https://ubuntu.com/security/CVE-2026-59848", "cve_description": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59850", "url": "https://ubuntu.com/security/CVE-2026-59850", "cve_description": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Denial of service via zero advertised channel packet size", " - debian/patches/CVE-2026-59843-1.patch: channels: Fail when receiving max", " packet size 0 in src/channels.c, src/messages.c.", " - debian/patches/CVE-2026-59843-2.patch: tests: Verify zero max packet size", " in channel open is rejected in tests/unittests/torture_channel.c.", " - CVE-2026-59843", " * SECURITY UPDATE: Denial of service via unchecked ProxyCommand fork() failure", " - debian/patches/CVE-2026-59845.patch: socket: Properly check fork() return", " code in src/socket.c.", " - CVE-2026-59845", " * SECURITY UPDATE: Information disclosure via ProxyCommand %r username", " expansion", " - debian/patches/CVE-2026-59846-pre1.patch: misc: Add function to check", " username syntax in include/libssh/misc.h, src/misc.c,", " tests/unittests/torture_misc.c.", " - debian/patches/CVE-2026-59846.patch: Block shell metacharacters from", " usernames in include/libssh/priv.h, src/misc.c.", " - CVE-2026-59846", " * SECURITY UPDATE: Integrity downgrade via OpenSSL AES-GCM tag verification", " - debian/patches/CVE-2026-59847-1.patch: libcrypto: Fix tag verification of", " AES-GCM ciphers in src/libcrypto.c.", " - debian/patches/CVE-2026-59847-2.patch: libcrypto: Fix symmetric issue", " during encryption in src/libcrypto.c.", " - CVE-2026-59847", " * SECURITY UPDATE: Denial of service via SFTP responses with unknown request", " IDs", " - debian/patches/CVE-2026-59848-1.patch: sftp: handle responses with unknown", " request IDs in include/libssh/sftp.h, src/sftp.c,", " tests/client/torture_sftp_request_id.c, tests/client/CMakeLists.txt.", " - debian/patches/CVE-2026-59848-2.patch: sftp: Initialize sftp_request_queue", " ptr in sftp_free in src/sftp.c.", " - CVE-2026-59848", " * SECURITY UPDATE: Use-after-free via data callbacks on closed channels", " - debian/patches/CVE-2026-59850.patch: channels: Avoid processing DATA", " packets on closed channels in src/channels.c.", " - CVE-2026-59850", "" ], "package": "libssh", "version": "0.9.6-2ubuntu0.22.04.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 24 Aug 2026 11:20:14 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libtinfo6:armhf", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.2", "version": "6.3-2ubuntu0.2" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.3", "version": "6.3-2ubuntu0.3" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.3-2ubuntu0.3", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:57 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libuuid1:armhf", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-generic-lpae", "from_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.190.169", "version": "5.15.0.190.169" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.191.169", "version": "5.15.0.191.169" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump ABI 5.15.0-191", "" ], "package": "linux-meta", "version": "5.15.0.191.169", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Mehmet Basaran ", "date": "Fri, 07 Aug 2026 20:58:40 +0300" }, { "cves": [], "log": [ "", " * Bump ABI 5.15.0-189", "" ], "package": "linux-meta", "version": "5.15.0.189.168", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:44:08 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-generic-lpae", "from_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.190.169", "version": "5.15.0.190.169" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.191.169", "version": "5.15.0.191.169" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump ABI 5.15.0-191", "" ], "package": "linux-meta", "version": "5.15.0.191.169", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Mehmet Basaran ", "date": "Fri, 07 Aug 2026 20:58:40 +0300" }, { "cves": [], "log": [ "", " * Bump ABI 5.15.0-189", "" ], "package": "linux-meta", "version": "5.15.0.189.168", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:44:08 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-generic-lpae", "from_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.190.169", "version": "5.15.0.190.169" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.191.169", "version": "5.15.0.191.169" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump ABI 5.15.0-191", "" ], "package": "linux-meta", "version": "5.15.0.191.169", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Mehmet Basaran ", "date": "Fri, 07 Aug 2026 20:58:40 +0300" }, { "cves": [], "log": [ "", " * Bump ABI 5.15.0-189", "" ], "package": "linux-meta", "version": "5.15.0.189.168", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:44:08 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "locales", "from_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.14", "version": "2.35-0ubuntu3.14" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.15", "version": "2.35-0ubuntu3.15" }, "cves": [ { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.35-0ubuntu3.15", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:20:04 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "mount", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ncurses-base", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.2", "version": "6.3-2ubuntu0.2" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.3", "version": "6.3-2ubuntu0.3" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.3-2ubuntu0.3", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:57 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ncurses-bin", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.2", "version": "6.3-2ubuntu0.2" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.3", "version": "6.3-2ubuntu0.3" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.3-2ubuntu0.3", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:57 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ncurses-term", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.2", "version": "6.3-2ubuntu0.2" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.3-2ubuntu0.3", "version": "6.3-2ubuntu0.3" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.3-2ubuntu0.3", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:57 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.16", "version": "1:8.9p1-3ubuntu0.16" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.17", "version": "1:8.9p1-3ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.17", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:39:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.16", "version": "1:8.9p1-3ubuntu0.16" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.17", "version": "1:8.9p1-3ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.17", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:39:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.16", "version": "1:8.9p1-3ubuntu0.16" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.17", "version": "1:8.9p1-3ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.17", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:39:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-modules-5.34", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 03 Sep 2026 10:50:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-pyasn1", "from_version": { "source_package_name": "pyasn1", "source_package_version": "0.4.8-1ubuntu0.2", "version": "0.4.8-1ubuntu0.2" }, "to_version": { "source_package_name": "pyasn1", "source_package_version": "0.4.8-1ubuntu0.3", "version": "0.4.8-1ubuntu0.3" }, "cves": [ { "cve": "CVE-2026-59886", "url": "https://ubuntu.com/security/CVE-2026-59886", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59884", "url": "https://ubuntu.com/security/CVE-2026-59884", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59885", "url": "https://ubuntu.com/security/CVE-2026-59885", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59886", "url": "https://ubuntu.com/security/CVE-2026-59886", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59884", "url": "https://ubuntu.com/security/CVE-2026-59884", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" }, { "cve": "CVE-2026-59885", "url": "https://ubuntu.com/security/CVE-2026-59885", "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.", "cve_priority": "medium", "cve_public_date": "2026-07-14 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pyasn1 BER/CER/DER decoder denial of service via", " unbounded long-form tag IDs ", " - debian/patches/CVE-2026-59886.patch: Merge commit from fork in", " pyasn1/type/univ.py, tests/codec/ber/test_decoder.py,", " tests/codec/cer/test_decoder.py, tests/codec/der/test_decoder.py,", " tests/type/test_univ.py.", " - CVE-2026-59886", " * SECURITY UPDATE: Quadratic complexity in OBJECT IDENTIFIER and", " RELATIVE-OID processing allows denial of service", " - debian/patches/CVE-2026-59884.patch: Merge commit from fork in", " pyasn1/codec/ber/decoder.py, pyasn1/type/tag.py,", " tests/codec/ber/test_decoder.py, tests/codec/cer/test_decoder.py,", " tests/codec/der/test_decoder.py, tests/type/test_tag.py.", " - CVE-2026-59884", " * SECURITY UPDATE: Uncontrolled resource consumption when converting", " decoded REAL values", " - debian/patches/CVE-2026-59885.patch: Merge commit from fork in", " pyasn1/codec/ber/decoder.py, pyasn1/codec/ber/encoder.py,", " tests/codec/ber/test_decoder.py, tests/codec/ber/test_encoder.py.", " - CVE-2026-59885", "" ], "package": "pyasn1", "version": "0.4.8-1ubuntu0.3", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 20 Aug 2026 18:00:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.10", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.18", "version": "3.10.12-1~22.04.18" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:17 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.10-minimal", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.18", "version": "3.10.12-1~22.04.18" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:17 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "util-linux", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "uuid-runtime", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.5", "version": "2.37.2-4ubuntu3.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.37.2-4ubuntu3.6", "version": "2.37.2-4ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/context_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in include/fileutils.h, lib/fileutils.c.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.37.2-4ubuntu3.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 13:43:12 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [ { "name": "core22", "from_version": { "source_package_name": null, "source_package_version": null, "version": "2439" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": "2957" } }, { "name": "snapd", "from_version": { "source_package_name": null, "source_package_version": null, "version": "27711" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": "27739" } } ] }, "added": { "deb": [ { "name": "linux-headers-5.15.0-191", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "5.15.0-191.201", "version": "5.15.0-191.201" }, "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53086", "url": "https://ubuntu.com/security/CVE-2026-53086", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.", "cve_priority": "high", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-43499", "url": "https://ubuntu.com/security/CVE-2026-43499", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the \tchangelog ]", "cve_priority": "high", "cve_public_date": "2026-05-21 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-52989", "url": "https://ubuntu.com/security/CVE-2026-52989", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.", "cve_priority": "critical", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-43378", "url": "https://ubuntu.com/security/CVE-2026-43378", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window.", "cve_priority": "high", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2025-27558", "url": "https://ubuntu.com/security/CVE-2025-27558", "cve_description": "IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.", "cve_priority": "medium", "cve_public_date": "2025-05-21 19:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46266", "url": "https://ubuntu.com/security/CVE-2026-46266", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\") pkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner \"man 7 raw\" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets.", "cve_priority": "medium", "cve_public_date": "2026-06-03 18:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-31705", "url": "https://ubuntu.com/security/CVE-2026-31705", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix potencial OOB in get_file_all_info() for compound requests\") and commit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound requests\"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.", "cve_priority": "high", "cve_public_date": "2026-05-01 14:16:00 UTC" }, { "cve": "CVE-2026-31448", "url": "https://ubuntu.com/security/CVE-2026-31448", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about \"inserted\" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]", "cve_priority": "low", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-31414", "url": "https://ubuntu.com/security/CVE-2026-31414", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.", "cve_priority": "high", "cve_public_date": "2026-04-13 14:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2163031, 2162294, 2160896, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)", "", " * CVE-2026-53246", " - sctp: delete the nested flexible array peer_init", "" ], "package": "linux", "version": "5.15.0-190.200", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2163031 ], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 14:57:54 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "5.15.0-188.198", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2162294 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:32 +0200" }, { "cves": [ { "cve": "CVE-2026-53086", "url": "https://ubuntu.com/security/CVE-2026-53086", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.", "cve_priority": "high", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-43499", "url": "https://ubuntu.com/security/CVE-2026-43499", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the \tchangelog ]", "cve_priority": "high", "cve_public_date": "2026-05-21 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-52989", "url": "https://ubuntu.com/security/CVE-2026-52989", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.", "cve_priority": "critical", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-43378", "url": "https://ubuntu.com/security/CVE-2026-43378", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window.", "cve_priority": "high", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2025-27558", "url": "https://ubuntu.com/security/CVE-2025-27558", "cve_description": "IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.", "cve_priority": "medium", "cve_public_date": "2025-05-21 19:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46266", "url": "https://ubuntu.com/security/CVE-2026-46266", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\") pkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner \"man 7 raw\" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets.", "cve_priority": "medium", "cve_public_date": "2026-06-03 18:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-31705", "url": "https://ubuntu.com/security/CVE-2026-31705", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix potencial OOB in get_file_all_info() for compound requests\") and commit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound requests\"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.", "cve_priority": "high", "cve_public_date": "2026-05-01 14:16:00 UTC" }, { "cve": "CVE-2026-31448", "url": "https://ubuntu.com/security/CVE-2026-31448", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about \"inserted\" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]", "cve_priority": "low", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-31414", "url": "https://ubuntu.com/security/CVE-2026-31414", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.", "cve_priority": "high", "cve_public_date": "2026-04-13 14:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-187.197 -proposed tracker (LP: #2160896)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " - [Packaging] resync retpoline extraction", "", " * CVE-2026-53086", " - net: bcmgenet: fix racing timeout handler", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-43499", " - rtmutex: Use waiter::task instead of current in remove_waiter()", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-52989", " - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-43378", " - smb: server: fix use-after-free in smb2_open()", "", " * CVE-2025-27558", " - wifi: prevent A-MSDU attacks in mesh networks", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-46266", " - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP", "", " * CVE-2026-43198", " - tcp: fix potential race in tcp_v6_syn_recv_sock()", "", " * CVE-2026-31705", " - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment", "", " * CVE-2026-31448", " - ext4: avoid infinite loops caused by residual data", "", " * CVE-2026-31414", " - netfilter: nf_conntrack_expect: use expect->helper", "" ], "package": "linux", "version": "5.15.0-187.197", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2160896, 1786013 ], "author": "Manuel Diewald ", "date": "Fri, 17 Jul 2026 15:36:42 +0200" } ], "notes": "linux-headers-5.15.0-191 version '5.15.0-191.201' (source package linux version '5.15.0-191.201') was added. linux-headers-5.15.0-191 version '5.15.0-191.201' has the same source package name, linux, as removed package linux-headers-5.15.0-190. As such we can use the source package version of the removed package, '5.15.0-190.200', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-headers-5.15.0-191-generic-lpae", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "5.15.0-191.201", "version": "5.15.0-191.201" }, "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53086", "url": "https://ubuntu.com/security/CVE-2026-53086", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.", "cve_priority": "high", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-43499", "url": "https://ubuntu.com/security/CVE-2026-43499", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the \tchangelog ]", "cve_priority": "high", "cve_public_date": "2026-05-21 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-52989", "url": "https://ubuntu.com/security/CVE-2026-52989", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.", "cve_priority": "critical", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-43378", "url": "https://ubuntu.com/security/CVE-2026-43378", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window.", "cve_priority": "high", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2025-27558", "url": "https://ubuntu.com/security/CVE-2025-27558", "cve_description": "IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.", "cve_priority": "medium", "cve_public_date": "2025-05-21 19:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46266", "url": "https://ubuntu.com/security/CVE-2026-46266", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\") pkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner \"man 7 raw\" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets.", "cve_priority": "medium", "cve_public_date": "2026-06-03 18:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-31705", "url": "https://ubuntu.com/security/CVE-2026-31705", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix potencial OOB in get_file_all_info() for compound requests\") and commit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound requests\"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.", "cve_priority": "high", "cve_public_date": "2026-05-01 14:16:00 UTC" }, { "cve": "CVE-2026-31448", "url": "https://ubuntu.com/security/CVE-2026-31448", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about \"inserted\" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]", "cve_priority": "low", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-31414", "url": "https://ubuntu.com/security/CVE-2026-31414", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.", "cve_priority": "high", "cve_public_date": "2026-04-13 14:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2163031, 2162294, 2160896, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)", "", " * CVE-2026-53246", " - sctp: delete the nested flexible array peer_init", "" ], "package": "linux", "version": "5.15.0-190.200", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2163031 ], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 14:57:54 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "5.15.0-188.198", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2162294 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:32 +0200" }, { "cves": [ { "cve": "CVE-2026-53086", "url": "https://ubuntu.com/security/CVE-2026-53086", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.", "cve_priority": "high", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-43499", "url": "https://ubuntu.com/security/CVE-2026-43499", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the \tchangelog ]", "cve_priority": "high", "cve_public_date": "2026-05-21 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-52989", "url": "https://ubuntu.com/security/CVE-2026-52989", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.", "cve_priority": "critical", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-43378", "url": "https://ubuntu.com/security/CVE-2026-43378", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window.", "cve_priority": "high", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2025-27558", "url": "https://ubuntu.com/security/CVE-2025-27558", "cve_description": "IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.", "cve_priority": "medium", "cve_public_date": "2025-05-21 19:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46266", "url": "https://ubuntu.com/security/CVE-2026-46266", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\") pkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner \"man 7 raw\" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets.", "cve_priority": "medium", "cve_public_date": "2026-06-03 18:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-31705", "url": "https://ubuntu.com/security/CVE-2026-31705", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix potencial OOB in get_file_all_info() for compound requests\") and commit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound requests\"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.", "cve_priority": "high", "cve_public_date": "2026-05-01 14:16:00 UTC" }, { "cve": "CVE-2026-31448", "url": "https://ubuntu.com/security/CVE-2026-31448", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about \"inserted\" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]", "cve_priority": "low", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-31414", "url": "https://ubuntu.com/security/CVE-2026-31414", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.", "cve_priority": "high", "cve_public_date": "2026-04-13 14:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-187.197 -proposed tracker (LP: #2160896)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " - [Packaging] resync retpoline extraction", "", " * CVE-2026-53086", " - net: bcmgenet: fix racing timeout handler", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-43499", " - rtmutex: Use waiter::task instead of current in remove_waiter()", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-52989", " - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-43378", " - smb: server: fix use-after-free in smb2_open()", "", " * CVE-2025-27558", " - wifi: prevent A-MSDU attacks in mesh networks", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-46266", " - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP", "", " * CVE-2026-43198", " - tcp: fix potential race in tcp_v6_syn_recv_sock()", "", " * CVE-2026-31705", " - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment", "", " * CVE-2026-31448", " - ext4: avoid infinite loops caused by residual data", "", " * CVE-2026-31414", " - netfilter: nf_conntrack_expect: use expect->helper", "" ], "package": "linux", "version": "5.15.0-187.197", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2160896, 1786013 ], "author": "Manuel Diewald ", "date": "Fri, 17 Jul 2026 15:36:42 +0200" } ], "notes": "linux-headers-5.15.0-191-generic-lpae version '5.15.0-191.201' (source package linux version '5.15.0-191.201') was added. linux-headers-5.15.0-191-generic-lpae version '5.15.0-191.201' has the same source package name, linux, as removed package linux-headers-5.15.0-190. As such we can use the source package version of the removed package, '5.15.0-190.200', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-image-5.15.0-191-generic-lpae", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "5.15.0-191.201", "version": "5.15.0-191.201" }, "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53086", "url": "https://ubuntu.com/security/CVE-2026-53086", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.", "cve_priority": "high", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-43499", "url": "https://ubuntu.com/security/CVE-2026-43499", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the \tchangelog ]", "cve_priority": "high", "cve_public_date": "2026-05-21 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-52989", "url": "https://ubuntu.com/security/CVE-2026-52989", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.", "cve_priority": "critical", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-43378", "url": "https://ubuntu.com/security/CVE-2026-43378", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window.", "cve_priority": "high", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2025-27558", "url": "https://ubuntu.com/security/CVE-2025-27558", "cve_description": "IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.", "cve_priority": "medium", "cve_public_date": "2025-05-21 19:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46266", "url": "https://ubuntu.com/security/CVE-2026-46266", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\") pkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner \"man 7 raw\" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets.", "cve_priority": "medium", "cve_public_date": "2026-06-03 18:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-31705", "url": "https://ubuntu.com/security/CVE-2026-31705", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix potencial OOB in get_file_all_info() for compound requests\") and commit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound requests\"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.", "cve_priority": "high", "cve_public_date": "2026-05-01 14:16:00 UTC" }, { "cve": "CVE-2026-31448", "url": "https://ubuntu.com/security/CVE-2026-31448", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about \"inserted\" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]", "cve_priority": "low", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-31414", "url": "https://ubuntu.com/security/CVE-2026-31414", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.", "cve_priority": "high", "cve_public_date": "2026-04-13 14:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2163031, 2162294, 2160896, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)", "", " * CVE-2026-53246", " - sctp: delete the nested flexible array peer_init", "" ], "package": "linux", "version": "5.15.0-190.200", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2163031 ], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 14:57:54 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "5.15.0-188.198", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2162294 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:32 +0200" }, { "cves": [ { "cve": "CVE-2026-53086", "url": "https://ubuntu.com/security/CVE-2026-53086", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.", "cve_priority": "high", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-43499", "url": "https://ubuntu.com/security/CVE-2026-43499", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the \tchangelog ]", "cve_priority": "high", "cve_public_date": "2026-05-21 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-52989", "url": "https://ubuntu.com/security/CVE-2026-52989", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.", "cve_priority": "critical", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-43378", "url": "https://ubuntu.com/security/CVE-2026-43378", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window.", "cve_priority": "high", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2025-27558", "url": "https://ubuntu.com/security/CVE-2025-27558", "cve_description": "IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.", "cve_priority": "medium", "cve_public_date": "2025-05-21 19:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46266", "url": "https://ubuntu.com/security/CVE-2026-46266", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\") pkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner \"man 7 raw\" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets.", "cve_priority": "medium", "cve_public_date": "2026-06-03 18:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-31705", "url": "https://ubuntu.com/security/CVE-2026-31705", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix potencial OOB in get_file_all_info() for compound requests\") and commit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound requests\"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.", "cve_priority": "high", "cve_public_date": "2026-05-01 14:16:00 UTC" }, { "cve": "CVE-2026-31448", "url": "https://ubuntu.com/security/CVE-2026-31448", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about \"inserted\" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]", "cve_priority": "low", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-31414", "url": "https://ubuntu.com/security/CVE-2026-31414", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.", "cve_priority": "high", "cve_public_date": "2026-04-13 14:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-187.197 -proposed tracker (LP: #2160896)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " - [Packaging] resync retpoline extraction", "", " * CVE-2026-53086", " - net: bcmgenet: fix racing timeout handler", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-43499", " - rtmutex: Use waiter::task instead of current in remove_waiter()", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-52989", " - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-43378", " - smb: server: fix use-after-free in smb2_open()", "", " * CVE-2025-27558", " - wifi: prevent A-MSDU attacks in mesh networks", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-46266", " - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP", "", " * CVE-2026-43198", " - tcp: fix potential race in tcp_v6_syn_recv_sock()", "", " * CVE-2026-31705", " - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment", "", " * CVE-2026-31448", " - ext4: avoid infinite loops caused by residual data", "", " * CVE-2026-31414", " - netfilter: nf_conntrack_expect: use expect->helper", "" ], "package": "linux", "version": "5.15.0-187.197", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2160896, 1786013 ], "author": "Manuel Diewald ", "date": "Fri, 17 Jul 2026 15:36:42 +0200" } ], "notes": "linux-image-5.15.0-191-generic-lpae version '5.15.0-191.201' (source package linux version '5.15.0-191.201') was added. linux-image-5.15.0-191-generic-lpae version '5.15.0-191.201' has the same source package name, linux, as removed package linux-headers-5.15.0-190. As such we can use the source package version of the removed package, '5.15.0-190.200', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-5.15.0-191-generic-lpae", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "5.15.0-191.201", "version": "5.15.0-191.201" }, "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53086", "url": "https://ubuntu.com/security/CVE-2026-53086", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.", "cve_priority": "high", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-43499", "url": "https://ubuntu.com/security/CVE-2026-43499", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the \tchangelog ]", "cve_priority": "high", "cve_public_date": "2026-05-21 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-52989", "url": "https://ubuntu.com/security/CVE-2026-52989", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.", "cve_priority": "critical", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-43378", "url": "https://ubuntu.com/security/CVE-2026-43378", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window.", "cve_priority": "high", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2025-27558", "url": "https://ubuntu.com/security/CVE-2025-27558", "cve_description": "IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.", "cve_priority": "medium", "cve_public_date": "2025-05-21 19:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46266", "url": "https://ubuntu.com/security/CVE-2026-46266", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\") pkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner \"man 7 raw\" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets.", "cve_priority": "medium", "cve_public_date": "2026-06-03 18:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-31705", "url": "https://ubuntu.com/security/CVE-2026-31705", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix potencial OOB in get_file_all_info() for compound requests\") and commit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound requests\"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.", "cve_priority": "high", "cve_public_date": "2026-05-01 14:16:00 UTC" }, { "cve": "CVE-2026-31448", "url": "https://ubuntu.com/security/CVE-2026-31448", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about \"inserted\" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]", "cve_priority": "low", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-31414", "url": "https://ubuntu.com/security/CVE-2026-31414", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.", "cve_priority": "high", "cve_public_date": "2026-04-13 14:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2163031, 2162294, 2160896, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)", "", " * CVE-2026-53246", " - sctp: delete the nested flexible array peer_init", "" ], "package": "linux", "version": "5.15.0-190.200", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2163031 ], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 14:57:54 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "5.15.0-188.198", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2162294 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:32 +0200" }, { "cves": [ { "cve": "CVE-2026-53086", "url": "https://ubuntu.com/security/CVE-2026-53086", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.", "cve_priority": "high", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-43499", "url": "https://ubuntu.com/security/CVE-2026-43499", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the \tchangelog ]", "cve_priority": "high", "cve_public_date": "2026-05-21 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-52989", "url": "https://ubuntu.com/security/CVE-2026-52989", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers.", "cve_priority": "critical", "cve_public_date": "2026-06-24 17:17:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-43378", "url": "https://ubuntu.com/security/CVE-2026-43378", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window.", "cve_priority": "high", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2025-27558", "url": "https://ubuntu.com/security/CVE-2025-27558", "cve_description": "IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.", "cve_priority": "medium", "cve_public_date": "2025-05-21 19:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46266", "url": "https://ubuntu.com/security/CVE-2026-46266", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\") pkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner \"man 7 raw\" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets.", "cve_priority": "medium", "cve_public_date": "2026-06-03 18:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-31705", "url": "https://ubuntu.com/security/CVE-2026-31705", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix potencial OOB in get_file_all_info() for compound requests\") and commit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound requests\"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.", "cve_priority": "high", "cve_public_date": "2026-05-01 14:16:00 UTC" }, { "cve": "CVE-2026-31448", "url": "https://ubuntu.com/security/CVE-2026-31448", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about \"inserted\" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]", "cve_priority": "low", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-31414", "url": "https://ubuntu.com/security/CVE-2026-31414", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.", "cve_priority": "high", "cve_public_date": "2026-04-13 14:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-187.197 -proposed tracker (LP: #2160896)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " - [Packaging] resync retpoline extraction", "", " * CVE-2026-53086", " - net: bcmgenet: fix racing timeout handler", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-43499", " - rtmutex: Use waiter::task instead of current in remove_waiter()", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-52989", " - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-43378", " - smb: server: fix use-after-free in smb2_open()", "", " * CVE-2025-27558", " - wifi: prevent A-MSDU attacks in mesh networks", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-46266", " - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP", "", " * CVE-2026-43198", " - tcp: fix potential race in tcp_v6_syn_recv_sock()", "", " * CVE-2026-31705", " - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment", "", " * CVE-2026-31448", " - ext4: avoid infinite loops caused by residual data", "", " * CVE-2026-31414", " - netfilter: nf_conntrack_expect: use expect->helper", "" ], "package": "linux", "version": "5.15.0-187.197", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2160896, 1786013 ], "author": "Manuel Diewald ", "date": "Fri, 17 Jul 2026 15:36:42 +0200" } ], "notes": "linux-modules-5.15.0-191-generic-lpae version '5.15.0-191.201' (source package linux version '5.15.0-191.201') was added. linux-modules-5.15.0-191-generic-lpae version '5.15.0-191.201' has the same source package name, linux, as removed package linux-headers-5.15.0-190. As such we can use the source package version of the removed package, '5.15.0-190.200', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-headers-5.15.0-190", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": "5.15.0-190.200" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-5.15.0-190-generic-lpae", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": "5.15.0-190.200" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-5.15.0-190-generic-lpae", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": "5.15.0-190.200" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-5.15.0-190-generic-lpae", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": "5.15.0-190.200" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from daily image serial 20260829 to 20260913", "from_series": "jammy", "to_series": "jammy", "from_serial": "20260829", "to_serial": "20260913", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }