{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-image-6.8.0-139-generic", "linux-modules-6.8.0-139-generic" ], "removed": [ "linux-image-6.8.0-138-generic", "linux-modules-6.8.0-138-generic" ], "diff": [ "bsdutils", "coreutils", "cpio", "diffutils", "fdisk", "gpgv", "libattr1", "libblkid1", "libbz2-1.0", "libfdisk1", "libgcrypt20", "libmount1", "libncursesw6", "libp11-kit0", "libpam-modules", "libpam-modules-bin", "libpam-runtime", "libpam0g", "libsmartcols1", "libssh-4", "libtinfo6", "libuuid1", "linux-image-virtual", "mount", "ncurses-base", "ncurses-bin", "openssh-client", "openssh-server", "openssh-sftp-server", "perl-base", "util-linux", "zlib1g" ] } }, "diff": { "deb": [ { "name": "bsdutils", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "1:2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "1:2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "coreutils", "from_version": { "source_package_name": "coreutils", "source_package_version": "9.4-3ubuntu6.2", "version": "9.4-3ubuntu6.2" }, "to_version": { "source_package_name": "coreutils", "source_package_version": "9.4-3ubuntu6.3", "version": "9.4-3ubuntu6.3" }, "cves": [ { "cve": "CVE-2025-5278", "url": "https://ubuntu.com/security/CVE-2025-5278", "cve_description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "cve_priority": "low", "cve_public_date": "2025-05-27 21:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-5278", "url": "https://ubuntu.com/security/CVE-2025-5278", "cve_description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "cve_priority": "low", "cve_public_date": "2025-05-27 21:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: out-of-bounds read in sort", " - debian/patches/CVE-2025-5278.patch: sort: fix buffer under-read in", " src/sort.c, tests/local.mk, tests/sort/sort-field-limit.sh,", " Makefile.in.", " - CVE-2025-5278", "" ], "package": "coreutils", "version": "9.4-3ubuntu6.3", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 25 Aug 2026 11:09:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "cpio", "from_version": { "source_package_name": "cpio", "source_package_version": "2.15+dfsg-1ubuntu2", "version": "2.15+dfsg-1ubuntu2" }, "to_version": { "source_package_name": "cpio", "source_package_version": "2.15+dfsg-1ubuntu2.1", "version": "2.15+dfsg-1ubuntu2.1" }, "cves": [ { "cve": "CVE-2026-66485", "url": "https://ubuntu.com/security/CVE-2026-66485", "cve_description": "GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66484", "url": "https://ubuntu.com/security/CVE-2026-66484", "cve_description": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66486", "url": "https://ubuntu.com/security/CVE-2026-66486", "cve_description": "GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2019-14866", "url": "https://ubuntu.com/security/CVE-2019-14866", "cve_description": "In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.", "cve_priority": "medium", "cve_public_date": "2020-01-07 17:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-66485", "url": "https://ubuntu.com/security/CVE-2026-66485", "cve_description": "GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66484", "url": "https://ubuntu.com/security/CVE-2026-66484", "cve_description": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2026-66486", "url": "https://ubuntu.com/security/CVE-2026-66486", "cve_description": "GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30", "cve_priority": "medium", "cve_public_date": "2026-08-10 11:17:00 UTC" }, { "cve": "CVE-2019-14866", "url": "https://ubuntu.com/security/CVE-2019-14866", "cve_description": "In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.", "cve_priority": "medium", "cve_public_date": "2020-01-07 17:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unbounded stack allocation", " - debian/patches/CVE-2026-66485.patch: Minor fixes in src/makepath.c,", " src/userspec.c.", " - CVE-2026-66485", " * SECURITY UPDATE: Hard link to file outside intended directory", " - debian/patches/CVE-2026-66484.patch: The --no-absolute-filenames option", " affects hard link targets too. in src/tar.c.", " - CVE-2026-66484", " * SECURITY UPDATE: Unescaped output", " - debian/patches/CVE-2026-66486.patch: Quote file names in error messages", " and in listings. in src/copyin.c, src/copyout.c, src/copypass.c,", " src/main.c, tests/CVE-2019-14866.at, tests/testsuite.", " - CVE-2026-66486", "" ], "package": "cpio", "version": "2.15+dfsg-1ubuntu2.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Isabel Garcia Contreras ", "date": "Tue, 18 Aug 2026 14:18:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "diffutils", "from_version": { "source_package_name": "diffutils", "source_package_version": "1:3.10-1build1", "version": "1:3.10-1build1" }, "to_version": { "source_package_name": "diffutils", "source_package_version": "1:3.10-1ubuntu0.1", "version": "1:3.10-1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Integer Overflow", " - debian/patches/CVE-2026-53910-1.patch: diff3: check for integer overflows", " when reading line numbers from diff in NEWS, THANKS, src/diff3.c.", " - debian/patches/CVE-2026-53910-2.patch: diff3: prevent overflow in line", " offsets in src/diff3.c.", " - CVE-2026-53910", "" ], "package": "diffutils", "version": "1:3.10-1ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 26 Aug 2026 14:15:46 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "fdisk", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgv", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libattr1", "from_version": { "source_package_name": "attr", "source_package_version": "1:2.5.2-1build1.1", "version": "1:2.5.2-1build1.1" }, "to_version": { "source_package_name": "attr", "source_package_version": "1:2.5.2-1ubuntu0.1", "version": "1:2.5.2-1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Symlink Traversal", " - d/p/CVE-2026-54371-01-add-visibility-attribute-header.patch: Add", " visibility attribute header in include/Makemodule.am, include/visibility-", " hidden.h.", " - d/p/CVE-2026-54371-02-add-xattrat-syscall-wrappers.patch: Add xattrat", " syscall wrappers in configure.ac, include/Makemodule.am,", " include/xattrat.h, libmisc/Makemodule.am, libmisc/xattrat.c.", " - d/p/CVE-2026-54371-03-add-xattrat-syscall-backwards-compatibility-", " code.patch: Add xattrat syscall backwards compatibility code in", " include/Makemodule.am, include/xattrat_compat.h, libmisc/Makemodule.am,", " libmisc/getxattrat_compat.c, libmisc/listxattrat_compat.c, libmisc/proc-", " self-fd.c, libmisc/proc-self-fd.h, libmisc/removexattrat_compat.c,", " libmisc/setxattrat_compat.c.", " - d/p/CVE-2026-54371-04-rename-walk_tree-to-old_walk_tree.patch: Rename", " walk_tree to old_walk_tree in include/Makemodule.am,", " include/old_walk_tree.h, libmisc/Makemodule.am, libmisc/old_walk_tree.c,", " tools/getfattr.c.", " - d/p/CVE-2026-54371-05-add-the-new-walk_tree-helper.patch: Add the new", " walk_tree helper in include/Makemodule.am, include/walk_tree.h,", " libmisc/Makemodule.am, libmisc/walk_tree.c.", " - debian/patches/CVE-2026-54371-06-harden-getfattr.patch: harden getfattr in", " man/man1/getfattr.1, tools/getfattr.c, test/root/getfattr.test.", " - d/p/CVE-2026-54371-07-setfattr-multiple-restore-accesses-freed-", " buffer.patch: setfattr: multiple --restore accesses freed buffer in", " tools/setfattr.c.", " - d/p/CVE-2026-54371-08-setfattr-do-not-ignore-no-dereference-after-", " restore.patch: setfattr: Do not ignore --no-dereference after --restore in", " tools/setfattr.c.", " - d/p/CVE-2026-54371-09-add-openat2-syscall-wrapper.patch: Add openat2", " syscall wrapper in configure.ac, include/Makemodule.am, include/openat2.h,", " libmisc/Makemodule.am, libmisc/openat2.c.", " - debian/patches/CVE-2026-54371-10-harden-setfattr-restore.patch: harden", " setfattr --restore in configure.ac, man/man1/setfattr.1,", " test/Makemodule.am, tools/setfattr.c, test/restore.test.", " - CVE-2026-54371", "" ], "package": "attr", "version": "1:2.5.2-1ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Sun, 23 Aug 2026 21:39:46 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblkid1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbz2-1.0", "from_version": { "source_package_name": "bzip2", "source_package_version": "1.0.8-5.1build0.1", "version": "1.0.8-5.1build0.1" }, "to_version": { "source_package_name": "bzip2", "source_package_version": "1.0.8-5.1ubuntu0.1", "version": "1.0.8-5.1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-42250", "url": "https://ubuntu.com/security/CVE-2026-42250", "cve_description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "cve_priority": "low", "cve_public_date": "2026-05-28 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42250", "url": "https://ubuntu.com/security/CVE-2026-42250", "cve_description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "cve_priority": "low", "cve_public_date": "2026-05-28 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: out-of-bounds write", " - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not", " process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.", " - CVE-2026-42250", "" ], "package": "bzip2", "version": "1.0.8-5.1ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shishir Subedi ", "date": "Thu, 27 Aug 2026 09:50:50 +0545" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfdisk1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgcrypt20", "from_version": { "source_package_name": "libgcrypt20", "source_package_version": "1.10.3-2ubuntu0.1", "version": "1.10.3-2ubuntu0.1" }, "to_version": { "source_package_name": "libgcrypt20", "source_package_version": "1.10.3-2ubuntu0.2", "version": "1.10.3-2ubuntu0.2" }, "cves": [ { "cve": "CVE-2024-2236", "url": "https://ubuntu.com/security/CVE-2024-2236", "cve_description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "cve_priority": "low", "cve_public_date": "2024-03-06 22:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2024-2236", "url": "https://ubuntu.com/security/CVE-2024-2236", "cve_description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "cve_priority": "low", "cve_public_date": "2024-03-06 22:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: timing-based side-channel flaw in RSA implementation", " - debian/patches/CVE-2024-2236-1.patch: rsa: Do not accept invalid PKCS#1.5", " padding when deciphering in cipher/rsa-common.c, src/const-time.h.", " - debian/patches/CVE-2024-2236-2.patch: rsa: Constant time blinding removal", " in cipher/rsa.c, configure.ac, mpi/Makefile.am, mpi/mpi-internal.h,", " mpi/mpi-mul-cs.c, mpi/mpi-mul.c, src/gcrypt-int.h.", " - debian/patches/CVE-2024-2236-3.patch: Constant time conversion of the", " message to the SEXP in cipher/rsa.c, src/const-time.c, src/const-time.h,", " src/sexp.c.", " - debian/patches/CVE-2024-2236-4.patch: rsa: Implement constant-time", " conversion of MPI to string in cipher/rsa-common.c.", " - debian/patches/CVE-2024-2236-5.patch: cipher: Use the constant time", " conversion also for OAEP in cipher/rsa-common.c, cipher/rsa.c.", " - debian/patches/CVE-2024-2236-6.patch: Implement implicit rejection for", " PKCS#1.5 decipher in cipher/pubkey-internal.h, cipher/pubkey-util.c,", " cipher/rsa-common.c, cipher/rsa.c, src/cipher.h, src/const-time.c,", " src/const-time.h, tests/pkcs1v2-v15c.h, tests/pkcs1v2.c.", " - debian/rules: build with --enable-marvin-workaround.", " - Thanks for Red Hat for the patches!", " - CVE-2024-2236", "" ], "package": "libgcrypt20", "version": "1.10.3-2ubuntu0.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 24 Aug 2026 14:06:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libmount1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libncursesw6", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libp11-kit0", "from_version": { "source_package_name": "p11-kit", "source_package_version": "0.25.3-4ubuntu2.1", "version": "0.25.3-4ubuntu2.1" }, "to_version": { "source_package_name": "p11-kit", "source_package_version": "0.25.3-4ubuntu2.2", "version": "0.25.3-4ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-18938", "url": "https://ubuntu.com/security/CVE-2026-18938", "cve_description": "A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.", "cve_priority": "medium", "cve_public_date": "2026-08-07 09:16:00 UTC" }, { "cve": "CVE-2026-13757", "url": "https://ubuntu.com/security/CVE-2026-13757", "cve_description": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.", "cve_priority": "medium", "cve_public_date": "2026-06-29 19:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-18938", "url": "https://ubuntu.com/security/CVE-2026-18938", "cve_description": "A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.", "cve_priority": "medium", "cve_public_date": "2026-08-07 09:16:00 UTC" }, { "cve": "CVE-2026-13757", "url": "https://ubuntu.com/security/CVE-2026-13757", "cve_description": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.", "cve_priority": "medium", "cve_public_date": "2026-06-29 19:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: integer overflow in nested attribute decoding", " - debian/patches/CVE-2026-18938.patch: guard against overflow when", " decoding nested attributes (32-bit only, heap OOB write, DoS).", " - CVE-2026-18938", " * SECURITY UPDATE: unbounded recursion in RPC attribute parsing", " - debian/patches/CVE-2026-13757.patch: add recursion depth limit into", " RPC attribute parsing (stack exhaustion, DoS).", " - CVE-2026-13757", "" ], "package": "p11-kit", "version": "0.25.3-4ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Mon, 24 Aug 2026 13:57:12 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules-bin", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-runtime", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam0g", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [], "launchpad_bugs_fixed": [ 2164901 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsmartcols1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssh-4", "from_version": { "source_package_name": "libssh", "source_package_version": "0.10.6-2ubuntu0.4", "version": "0.10.6-2ubuntu0.4" }, "to_version": { "source_package_name": "libssh", "source_package_version": "0.10.6-2ubuntu0.5", "version": "0.10.6-2ubuntu0.5" }, "cves": [ { "cve": "CVE-2026-59843", "url": "https://ubuntu.com/security/CVE-2026-59843", "cve_description": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59845", "url": "https://ubuntu.com/security/CVE-2026-59845", "cve_description": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59846", "url": "https://ubuntu.com/security/CVE-2026-59846", "cve_description": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.", "cve_priority": "medium", "cve_public_date": "2026-07-21 13:17:00 UTC" }, { "cve": "CVE-2026-59847", "url": "https://ubuntu.com/security/CVE-2026-59847", "cve_description": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59848", "url": "https://ubuntu.com/security/CVE-2026-59848", "cve_description": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59850", "url": "https://ubuntu.com/security/CVE-2026-59850", "cve_description": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59843", "url": "https://ubuntu.com/security/CVE-2026-59843", "cve_description": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59845", "url": "https://ubuntu.com/security/CVE-2026-59845", "cve_description": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59846", "url": "https://ubuntu.com/security/CVE-2026-59846", "cve_description": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.", "cve_priority": "medium", "cve_public_date": "2026-07-21 13:17:00 UTC" }, { "cve": "CVE-2026-59847", "url": "https://ubuntu.com/security/CVE-2026-59847", "cve_description": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59848", "url": "https://ubuntu.com/security/CVE-2026-59848", "cve_description": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59850", "url": "https://ubuntu.com/security/CVE-2026-59850", "cve_description": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Denial of service via zero advertised channel packet size", " - debian/patches/CVE-2026-59843-1.patch: channels: Fail when receiving max", " packet size 0 in src/channels.c, src/messages.c.", " - debian/patches/CVE-2026-59843-2.patch: tests: Verify zero max packet size", " in channel open is rejected in tests/unittests/torture_channel.c.", " - CVE-2026-59843", " * SECURITY UPDATE: Denial of service via unchecked ProxyCommand fork() failure", " - debian/patches/CVE-2026-59845.patch: socket: Properly check fork() return", " code in src/socket.c.", " - CVE-2026-59845", " * SECURITY UPDATE: Information disclosure via ProxyCommand %r username", " expansion", " - debian/patches/CVE-2026-59846-pre1.patch: misc: Add function to check", " username syntax in include/libssh/misc.h, src/misc.c,", " tests/unittests/torture_misc.c.", " - debian/patches/CVE-2026-59846.patch: Block shell metacharacters from", " usernames in include/libssh/priv.h, src/misc.c.", " - CVE-2026-59846", " * SECURITY UPDATE: Integrity downgrade via OpenSSL AES-GCM tag verification", " - debian/patches/CVE-2026-59847-1.patch: libcrypto: Fix tag verification of", " AES-GCM ciphers in src/libcrypto.c.", " - debian/patches/CVE-2026-59847-2.patch: libcrypto: Fix symmetric issue", " during encryption in src/libcrypto.c.", " - CVE-2026-59847", " * SECURITY UPDATE: Denial of service via SFTP responses with unknown request", " IDs", " - debian/patches/CVE-2026-59848-1.patch: sftp: handle responses with unknown", " request IDs in include/libssh/sftp.h, src/sftp.c,", " tests/client/torture_sftp_request_id.c, tests/client/CMakeLists.txt.", " - debian/patches/CVE-2026-59848-2.patch: sftp: Initialize sftp_request_queue", " ptr in sftp_free in src/sftp.c.", " - CVE-2026-59848", " * SECURITY UPDATE: Use-after-free via data callbacks on closed channels", " - debian/patches/CVE-2026-59850.patch: channels: Avoid processing DATA", " packets on closed channels in src/channels.c.", " - CVE-2026-59850", "" ], "package": "libssh", "version": "0.10.6-2ubuntu0.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 24 Aug 2026 10:59:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libtinfo6", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libuuid1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-139.139", "version": "6.8.0-139.139" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 6.8.0-139.139", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta", "version": "6.8.0-139.139", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:25:54 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "mount", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ncurses-base", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ncurses-bin", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.18", "version": "1:9.6p1-3ubuntu13.18" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.19", "version": "1:9.6p1-3ubuntu13.19" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:9.6p1-3ubuntu13.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:38:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.18", "version": "1:9.6p1-3ubuntu13.18" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.19", "version": "1:9.6p1-3ubuntu13.19" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:9.6p1-3ubuntu13.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:38:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.18", "version": "1:9.6p1-3ubuntu13.18" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.19", "version": "1:9.6p1-3ubuntu13.19" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:9.6p1-3ubuntu13.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:38:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.3", "version": "5.38.2-3.2ubuntu0.3" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.4", "version": "5.38.2-3.2ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", " [ LeoSilva ]", " * SECURITY UPDATE: uncaught exception in IO::Uncompress::Unzip DOS date", " parsing", " - debian/patches/CVE-2025-15649.patch: wrap _dosToUnixTime() in eval", " and return zero for empty/out-of-range date fields in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2025-15649", " [ LeoSilva ]", " * SECURITY UPDATE: CPU exhaustion in IO::Uncompress::Unzip fastForward", " - debian/patches/CVE-2026-48959.patch: fix per-byte read loop caused", " by comparing length $offset instead of $offset in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2026-48959", " [ LeoSilva ]", " * SECURITY UPDATE: arbitrary code execution in File::GlobMapper", " - debian/patches/CVE-2026-48962.patch: remove use of eval STRING in", " _parseOutputGlob/_getFiles, replacing with safe delimiter-based", " substitution in cpan/IO-Compress/lib/File/GlobMapper.pm", " - CVE-2026-48962", " [ LeoSilva ]", " * SECURITY UPDATE: credential header leakage on cross-origin redirects", " in HTTP::Tiny", " - debian/patches/CVE-2026-7017.patch: strip Authorization, Cookie and", " Proxy-Authorization headers on cross-origin redirects, refuse", " https-to-http downgrade by default in", " cpan/HTTP-Tiny/lib/HTTP/Tiny.pm", " - CVE-2026-7017", " [ LeoSilva ]", " * SECURITY UPDATE: memory exhaustion in Archive::Tar entry size handling", " - debian/patches/CVE-2026-9538.patch: add $MAX_FILE_SIZE cap to", " refuse oversized entry declarations before allocation in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-9538", "" ], "package": "perl", "version": "5.38.2-3.2ubuntu0.4", "urgency": "high", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 18 Aug 2026 17:25:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "util-linux", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "zlib1g", "from_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg-3.1ubuntu2.1", "version": "1:1.3.dfsg-3.1ubuntu2.1" }, "to_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg-3.1ubuntu2.2", "version": "1:1.3.dfsg-3.1ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-27171", "url": "https://ubuntu.com/security/CVE-2026-27171", "cve_description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "cve_priority": "low", "cve_public_date": "2026-02-18 04:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-27171", "url": "https://ubuntu.com/security/CVE-2026-27171", "cve_description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "cve_priority": "low", "cve_public_date": "2026-02-18 04:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: resource consumption via infinite loop", " - debian/patches/CVE-2026-27171.patch: add negative length checks to", " crc32_combine64 and crc32_combine_gen64 functions in crc32.c", " - CVE-2026-27171", "" ], "package": "zlib", "version": "1:1.3.dfsg-3.1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Tue, 25 Aug 2026 13:41:30 +0300" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-image-6.8.0-139-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "6.8.0-138.138", "version": null }, "to_version": { "source_package_name": "linux-signed", "source_package_version": "6.8.0-139.139", "version": "6.8.0-139.139" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 6.8.0-139.139", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "6.8.0-139.139", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:26:05 +0200" } ], "notes": "linux-image-6.8.0-139-generic version '6.8.0-139.139' (source package linux-signed version '6.8.0-139.139') was added. linux-image-6.8.0-139-generic version '6.8.0-139.139' has the same source package name, linux-signed, as removed package linux-image-6.8.0-138-generic. As such we can use the source package version of the removed package, '6.8.0-138.138', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-6.8.0-139-generic", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-139.139", "version": "6.8.0-139.139" }, "cves": [ { "cve": "CVE-2025-71289", "url": "https://ubuntu.com/security/CVE-2025-71289", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.", "cve_priority": "medium", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-46315", "url": "https://ubuntu.com/security/CVE-2026-46315", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it does not initialize info itself. If the wait operation completes without reporting a child event, the common wait code can return without writing wo_info. In that case io_waitid_finish() still copies iw->info to userspace, exposing stale bytes from the reused io_kiocb command storage. Clear the result storage during prep so the io_uring path matches the regular waitid syscall, which uses a zero-initialized struct waitid_info.", "cve_priority": "medium", "cve_public_date": "2026-06-09 09:16:00 UTC" }, { "cve": "CVE-2026-31486", "url": "https://ubuntu.com/security/CVE-2026-31486", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h.", "cve_priority": "medium", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-23469", "url": "https://ubuntu.com/security/CVE-2026-23469", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU core and doesn't wait for it to finish. Depending on timing, the IRQ handler could be running while the GPU is suspended, leading to kernel crashes when trying to access GPU registers. See example signature below. In a power off sequence initiated by the runtime PM suspend callback, wait for any IRQ handlers in progress on other CPU cores to finish, by calling synchronize_irq(). At the same time, remove the runtime PM resume/put calls in the threaded IRQ handler. On top of not being the right approach to begin with, and being at the wrong place as they should have wrapped all GPU register accesses, the driver would hit a deadlock between synchronize_irq() being called from a runtime PM suspend callback, holding the device power lock, and the resume callback requiring the same. Example crash signature on a TI AM68 SK platform: [ 337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError [ 337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241246] Tainted: [M]=MACHINE_CHECK [ 337.241249] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 337.241256] pc : pvr_riscv_irq_pending+0xc/0x24 [ 337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310 [ 337.241282] sp : ffff800085b0bd30 [ 337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10 [ 337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000 [ 337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30 [ 337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001 [ 337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40 [ 337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a [ 337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00 [ 337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003 [ 337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000 [ 337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000 [ 337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt [ 337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241342] Tainted: [M]=MACHINE_CHECK [ 337.241343] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241345] Call trace: [ 337.241348] show_stack+0x18/0x24 (C) [ 337.241357] dump_stack_lvl+0x60/0x80 [ 337.241364] dump_stack+0x18/0x24 [ 337.241368] vpanic+0x124/0x2ec [ 337.241373] abort+0x0/0x4 [ 337.241377] add_taint+0x0/0xbc [ 337.241384] arm64_serror_panic+0x70/0x80 [ 337.241389] do_serror+0x3c/0x74 [ 337.241392] el1h_64_error_handler+0x30/0x48 [ 337.241400] el1h_64_error+0x6c/0x70 [ 337.241404] pvr_riscv_irq_pending+0xc/0x24 (P) [ 337.241410] irq_thread_fn+0x2c/0xb0 [ 337.241416] irq_thread+0x170/0x334 [ 337.241421] kthread+0x12c/0x210 [ 337.241428] ret_from_fork+0x10/0x20 [ 337.241434] SMP: stopping secondary CPUs [ 337.241451] Kernel Offset: disabled [ 337.241453] CPU features: 0x040000,02002800,20002001,0400421b [ 337.241456] Memory Limit: none [ 337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---", "cve_priority": "medium", "cve_public_date": "2026-04-03 16:16:00 UTC" }, { "cve": "CVE-2026-31560", "url": "https://ubuntu.com/security/CVE-2026-31560", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: spi: spi-dw-dma: fix print error log when wait finish transaction If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*).", "cve_priority": "medium", "cve_public_date": "2026-04-24 15:16:00 UTC" }, { "cve": "CVE-2026-31420", "url": "https://ubuntu.com/security/CVE-2026-31420", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.", "cve_priority": "medium", "cve_public_date": "2026-04-13 14:16:00 UTC" }, { "cve": "CVE-2026-46275", "url": "https://ubuntu.com/security/CVE-2026-46275", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.", "cve_priority": "high", "cve_public_date": "2026-06-08 16:16:00 UTC" }, { "cve": "CVE-2026-46170", "url": "https://ubuntu.com/security/CVE-2026-46170", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on \"itself\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-46158", "url": "https://ubuntu.com/security/CVE-2026-46158", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as \"unlikely\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46242", "url": "https://ubuntu.com/security/CVE-2026-46242", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.", "cve_priority": "high", "cve_public_date": "2026-05-30 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52931", "url": "https://ubuntu.com/security/CVE-2026-52931", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-52914", "url": "https://ubuntu.com/security/CVE-2026-52914", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-46325", "url": "https://ubuntu.com/security/CVE-2026-46325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/", "cve_priority": "low", "cve_public_date": "2026-06-09 14:16:00 UTC" }, { "cve": "CVE-2026-43465", "url": "https://ubuntu.com/security/CVE-2026-43465", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb: - The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0. - The test sends one packet with no payload. - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above. - The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain more data, the program drops the tail fragment since it no longer contains any payload (pp_ref_count=63). - mlx5 device skips counting this fragment. Internal frag counter remains 0. - mlx5 releases all 64 fragments of the page but page pp_ref_count is 63 => negative reference counting error. Resulting splat during the test: WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] Modules linked in: [...] CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] [...] Call Trace: mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] mlx5e_close_rq+0x78/0xa0 [mlx5_core] mlx5e_close_queues+0x46/0x2a0 [mlx5_core] mlx5e_close_channel+0x24/0x90 [mlx5_core] mlx5e_close_channels+0x5d/0xf0 [mlx5_core] mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] mlx5e_change_mtu+0x11d/0x490 [mlx5_core] mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] netif_set_mtu_ext+0xfc/0x240 do_setlink.isra.0+0x226/0x1100 rtnl_newlink+0x7a9/0xba0 rtnetlink_rcv_msg+0x220/0x3c0 netlink_rcv_skb+0x4b/0xf0 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x240 ___sys_sendmsg+0x7c/0xb0 [...] __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xc70 The problem applies for XDP_PASS as well which is handled in a different code path in the driver. This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag. As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags.", "cve_priority": "low", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43197", "url": "https://ubuntu.com/security/CVE-2026-43197", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)", "cve_priority": "negligible", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43083", "url": "https://ubuntu.com/security/CVE-2026-43083", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.", "cve_priority": "high", "cve_public_date": "2026-05-06 10:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162466, 1786013, 2072994, 2159608, 2160302, 2158920, 2139686, 2158462, 2155609, 2142613, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250 ], "changes": [ { "cves": [ { "cve": "CVE-2025-71289", "url": "https://ubuntu.com/security/CVE-2025-71289", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.", "cve_priority": "medium", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-46315", "url": "https://ubuntu.com/security/CVE-2026-46315", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it does not initialize info itself. If the wait operation completes without reporting a child event, the common wait code can return without writing wo_info. In that case io_waitid_finish() still copies iw->info to userspace, exposing stale bytes from the reused io_kiocb command storage. Clear the result storage during prep so the io_uring path matches the regular waitid syscall, which uses a zero-initialized struct waitid_info.", "cve_priority": "medium", "cve_public_date": "2026-06-09 09:16:00 UTC" }, { "cve": "CVE-2026-31486", "url": "https://ubuntu.com/security/CVE-2026-31486", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h.", "cve_priority": "medium", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-23469", "url": "https://ubuntu.com/security/CVE-2026-23469", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU core and doesn't wait for it to finish. Depending on timing, the IRQ handler could be running while the GPU is suspended, leading to kernel crashes when trying to access GPU registers. See example signature below. In a power off sequence initiated by the runtime PM suspend callback, wait for any IRQ handlers in progress on other CPU cores to finish, by calling synchronize_irq(). At the same time, remove the runtime PM resume/put calls in the threaded IRQ handler. On top of not being the right approach to begin with, and being at the wrong place as they should have wrapped all GPU register accesses, the driver would hit a deadlock between synchronize_irq() being called from a runtime PM suspend callback, holding the device power lock, and the resume callback requiring the same. Example crash signature on a TI AM68 SK platform: [ 337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError [ 337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241246] Tainted: [M]=MACHINE_CHECK [ 337.241249] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 337.241256] pc : pvr_riscv_irq_pending+0xc/0x24 [ 337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310 [ 337.241282] sp : ffff800085b0bd30 [ 337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10 [ 337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000 [ 337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30 [ 337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001 [ 337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40 [ 337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a [ 337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00 [ 337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003 [ 337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000 [ 337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000 [ 337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt [ 337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241342] Tainted: [M]=MACHINE_CHECK [ 337.241343] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241345] Call trace: [ 337.241348] show_stack+0x18/0x24 (C) [ 337.241357] dump_stack_lvl+0x60/0x80 [ 337.241364] dump_stack+0x18/0x24 [ 337.241368] vpanic+0x124/0x2ec [ 337.241373] abort+0x0/0x4 [ 337.241377] add_taint+0x0/0xbc [ 337.241384] arm64_serror_panic+0x70/0x80 [ 337.241389] do_serror+0x3c/0x74 [ 337.241392] el1h_64_error_handler+0x30/0x48 [ 337.241400] el1h_64_error+0x6c/0x70 [ 337.241404] pvr_riscv_irq_pending+0xc/0x24 (P) [ 337.241410] irq_thread_fn+0x2c/0xb0 [ 337.241416] irq_thread+0x170/0x334 [ 337.241421] kthread+0x12c/0x210 [ 337.241428] ret_from_fork+0x10/0x20 [ 337.241434] SMP: stopping secondary CPUs [ 337.241451] Kernel Offset: disabled [ 337.241453] CPU features: 0x040000,02002800,20002001,0400421b [ 337.241456] Memory Limit: none [ 337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---", "cve_priority": "medium", "cve_public_date": "2026-04-03 16:16:00 UTC" }, { "cve": "CVE-2026-31560", "url": "https://ubuntu.com/security/CVE-2026-31560", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: spi: spi-dw-dma: fix print error log when wait finish transaction If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*).", "cve_priority": "medium", "cve_public_date": "2026-04-24 15:16:00 UTC" }, { "cve": "CVE-2026-31420", "url": "https://ubuntu.com/security/CVE-2026-31420", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.", "cve_priority": "medium", "cve_public_date": "2026-04-13 14:16:00 UTC" }, { "cve": "CVE-2026-46275", "url": "https://ubuntu.com/security/CVE-2026-46275", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.", "cve_priority": "high", "cve_public_date": "2026-06-08 16:16:00 UTC" }, { "cve": "CVE-2026-46170", "url": "https://ubuntu.com/security/CVE-2026-46170", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on \"itself\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-46158", "url": "https://ubuntu.com/security/CVE-2026-46158", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as \"unlikely\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46242", "url": "https://ubuntu.com/security/CVE-2026-46242", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.", "cve_priority": "high", "cve_public_date": "2026-05-30 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52931", "url": "https://ubuntu.com/security/CVE-2026-52931", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-52914", "url": "https://ubuntu.com/security/CVE-2026-52914", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-46325", "url": "https://ubuntu.com/security/CVE-2026-46325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/", "cve_priority": "low", "cve_public_date": "2026-06-09 14:16:00 UTC" }, { "cve": "CVE-2026-43465", "url": "https://ubuntu.com/security/CVE-2026-43465", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb: - The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0. - The test sends one packet with no payload. - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above. - The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain more data, the program drops the tail fragment since it no longer contains any payload (pp_ref_count=63). - mlx5 device skips counting this fragment. Internal frag counter remains 0. - mlx5 releases all 64 fragments of the page but page pp_ref_count is 63 => negative reference counting error. Resulting splat during the test: WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] Modules linked in: [...] CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] [...] Call Trace: mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] mlx5e_close_rq+0x78/0xa0 [mlx5_core] mlx5e_close_queues+0x46/0x2a0 [mlx5_core] mlx5e_close_channel+0x24/0x90 [mlx5_core] mlx5e_close_channels+0x5d/0xf0 [mlx5_core] mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] mlx5e_change_mtu+0x11d/0x490 [mlx5_core] mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] netif_set_mtu_ext+0xfc/0x240 do_setlink.isra.0+0x226/0x1100 rtnl_newlink+0x7a9/0xba0 rtnetlink_rcv_msg+0x220/0x3c0 netlink_rcv_skb+0x4b/0xf0 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x240 ___sys_sendmsg+0x7c/0xb0 [...] __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xc70 The problem applies for XDP_PASS as well which is handled in a different code path in the driver. This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag. As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags.", "cve_priority": "low", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43197", "url": "https://ubuntu.com/security/CVE-2026-43197", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)", "cve_priority": "negligible", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43083", "url": "https://ubuntu.com/security/CVE-2026-43083", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.", "cve_priority": "high", "cve_public_date": "2026-05-06 10:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-139.139 -proposed tracker (LP: #2162466)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " - [Packaging] debian.master/dkms-versions -- update from kernel-versions", " (main/2026.08.03)", "", " * kselftests_net.net:test_bpf.sh fails on ppc64el (LP: #2072994)", " - powerpc64/bpf: jit support for 32bit offset jmp instruction", " - powerpc64/bpf: jit support for unconditional byte swap", " - powerpc64/bpf: jit support for sign extended load", " - powerpc64/bpf: jit support for sign extended mov", " - powerpc64/bpf: jit support for signed division and modulo", "", " * noble/linux-raspi FTBFS: bcmasp phylib managed-EEE backport missing", " prerequisites (LP: #2159608)", " - SAUCE: Revert \"net: bcm: asp2: convert to phylib managed EEE\"", " - SAUCE: Revert \"net: bcm: asp2: remove tx_lpi_enabled\"", " - SAUCE: Revert \"net: bcm: asp2: fix LPI timer handling\"", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * noble-stable-2026-06-16 dropped a bracket causing FTBFS (LP: #2158920)", " - SAUCE: drm/v3d: Fix bracket drop FTBFS for non-generic kernels", "", " * ubuntu_bpf failed to build on Noble ( error: ‘XDP_UMEM_TX_METADATA_LEN’", " undeclared ) (LP: #2139686)", " - selftests/bpf: Add XDP_UMEM_TX_METADATA_LEN to XSK TX metadata test", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * net/tls: Three upstream fixes without CVE missing from Ubuntu", " 6.8.0-124-generic (LP: #2155609)", " - net: tls: fix silent data drop under pipe back-pressure", "", " * net:fcnal-test.sh fails because it can't find wait_local_port_listen on", " noble (LP: #2142613)", " - selftests: net: move wait_local_port_listen to lib.sh", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250)", " - mptcp: sync the msk->sndbuf at accept() time", " - mptcp: pm: ADD_ADDR rtx: allow ID 0", " - s390/debug: Reject zero-length input before trimming a newline", " - Revert \"x86/vdso: Fix output operand size of RDPID\"", " - Revert \"s390/cio: Update purge function to unregister the unused", " subchannels\"", " - sysfs: don't remove existing directory on update failure", " - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()", " - smb: client: protect tc_count increment in", " smb2_find_smb_sess_tcon_unlocked()", " - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close", " - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX", " - ALSA: ua101: Reject too-short USB descriptors", " - ALSA: pcm: Don't setup bogus iov_iter for silencing", " - ALSA: asihpi: Fix potential OOB array access at reading cache", " - efi: Allocate runtime workqueue before ACPI init", " - drivers/base/memory: fix memory block reference leak in poison", " accounting", " - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()", " - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()", " - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START", " - Bluetooth: bnep: Fix UAF read of dev->name", " - Bluetooth: MGMT: validate Add Extended Advertising Data length", " - Bluetooth: serialize accept_q access", " - phonet/pep: disable BH around forwarded sk_receive_skb()", " - net: bcmgenet: keep RBUF EEE/PM disabled", " - net: ifb: report ethtool stats over num_tx_queues", " - netfilter: ip6t_hbh: reject oversized option lists", " - netfilter: nf_queue: hold bridge skb->dev while queued", " - netfilter: ipset: stop hash:* range iteration at end", " - qed: fix double free in qed_cxt_tables_alloc()", " - ring-buffer: Fix reporting of missed events in iterator", " - vsock/vmci: fix UAF when peer resets connection during handshake", " - vsock/virtio: reset connection on receiving queue overflow", " - wifi: ath11k: clear shared SRNG pointer state on restart", " - ipv4: raw: reject IP_HDRINCL packets with ihl < 5", " - ixgbevf: fix use-after-free in VEPA multicast source pruning", " - ice: fix setting promisc mode while adding VID filter", " - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()", " - cifs: Fix busy dentry used after unmounting", " - tracing: Do not call map->ops->elt_free() if elt_alloc() fails", " - arm64: probes: Handle probes on hinted conditional branch instructions", " - KVM: arm64: vgic-its: Reject restored DTE with out-of-range", " num_eventid_bits", " - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe", " - spi: qup: fix error pointer deref after DMA setup failure", " - phy: tegra: xusb: Fix per-pad high-speed termination calibration", " - scsi: isci: Fix use-after-free in device removal path", " - spi: sprd: fix error pointer deref after DMA setup failure", " - spi: ti-qspi: fix use-after-free after DMA setup failure", " - RDMA/siw: Reject MPA FPDU length underflow before signed receive math", " - LoongArch: Remove unused code to avoid build warning", " - device property: set fwnode->secondary to NULL in fwnode_init()", " - drm/virtio: use uninterruptible resv lock for plane updates", " - drm/bridge: it66121: acquire reset GPIO in probe", " - drm/bridge: megachips: remove bridge when irq request fails", " - drm/amd/display: Fix integer overflow in bios_get_image()", " - drm/amd/display: Validate GPIO pin LUT table size before iterating", " - drm/amd/display: Validate payload length and link_index in", " dc_process_dmub_aux_transfer_async", " - batman-adv: mcast: fix use-after-free in orig_node RCU release", " - batman-adv: clear current gateway during teardown", " - batman-adv: dat: handle forward allocation error", " - batman-adv: fix tp_meter counter underflow during shutdown", " - batman-adv: frag: disallow unicast fragment in fragment", " - batman-adv: bla: fix report_work leak on backbone_gw purge", " - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown", " - batman-adv: tp_meter: fix race condition in send error reporting", " - batman-adv: tt: fix negative last_changeset_len", " - batman-adv: tt: fix negative tt_buff_len", " - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock", " - hwmon: (pmbus/adm1266) reject implausible blackbox record_count", " - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer", " - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized", " buffer", " - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR", " - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in", " get_multiple", " - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()", " - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()", " - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO", " accessors", " - HID: uclogic: Fix regression of input name assignment", " - firmware: arm_ffa: Check for NULL FF-A ID table while driver", " registration", " - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure", " - kunit: config: Enable KUNIT_DEBUGFS by default", " - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS", " - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150", " - ARM: integrator: Fix early initialization", " - ALSA: hda: cs35l56: Put ACPI device after setting companion", " - netfilter: x_tables: unregister the templates first", " - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()", " - test_kprobes: clear kprobes between test runs", " - tcp: Fix imbalanced icsk_accept_queue count.", " - ice: fix locking in ice_dcb_rebuild()", " - net: lan966x: avoid unregistering netdev on register failure", " - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register", " access", " - irqchip/ath79-cpu: Remove unused function", " - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT", " - zonefs: handle integer overflow in zonefs_fname_to_fno", " - netfs: Fix overrun check in netfs_extract_user_iter()", " - net: ethernet: cortina: Make RX SKB per-port", " - net: ethernet: cortina: Drop half-assembled SKB", " - net: ethernet: cortina: Carry over frag counter", " - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference", " - wifi: ath11k: fix error path leaks in some WMI WOW calls", " - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()", " - accel/qaic: Add overflow check to remap_pfn_range during mmap", " - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint", " - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics", " - drm/msm/dsi: don't dump registers past the mapped region", " - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN", " - powerpc/time: Remove redundant preempt_disable|enable() calls from", " arch_irq_work_raise()", " - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot", " - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring", " - net: tls: prevent chain-after-chain in plain text SG", " - net: phy: DP83TC811: add reading of abilities", " - x86/xen: Fix xen_e820_swap_entry_with_ram()", " - tls: Preserve sk_err across recvmsg() when data has been copied", " - net/mlx5: Do not restore destination-less TC rules", " - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()", " - drm/msm/snapshot: fix dumping of the unaligned regions", " - wifi: ath11k: fix peer resolution on rx path when peer_id=0", " - net: dsa: mt7530: fix FDB entries not aging out with short timeout", " - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw", " - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames", " - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer", " - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL", " - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL", " - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL", " - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL", " - RDMA/rtrs: Fix use-after-free in path file creation cleanup", " - net: bridge: Flush multicast groups when snooping is disabled", " - bridge: mcast: Fix a possible use-after-free when removing a bridge port", " - pds_core: fix error handling in pdsc_devcmd_wait", " - pds_core: fix debugfs_lookup dentry leak and error handling", " - ALSA: seq: ump: Use guard() for locking", " - ALSA: seq: Serialize UMP output teardown with event_input", " - Bluetooth: btmtk: add the function to get the fw name", " - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset", " - Bluetooth: btmtk: rename btmediatek_data", " - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c", " - Bluetooth: btmtk: fix urb->setup_packet leak in error paths", " - net: ag71xx: check error for platform_get_irq", " - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx", " - string: add mem_is_zero() helper to check if memory area is all zeros", " - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)", " - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed", " - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()", " - net: mana: validate rx_req_idx to prevent out-of-bounds array access", " - pds_core: ensure null-termination for firmware version strings", " - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions", " - security/keys: fix missed RCU read section on lookup", " - ata: libata-scsi: improve readability of ata_scsi_qc_issue()", " - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT", " - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS", " - ata: libata-scsi: do not needlessly defer commands when using PMP with", " FBS", " - perf parse-events: Expose/rename config_term_name", " - net/mlx5e: Trigger neighbor resolution for unresolved destinations", " - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC", " init", " - ksmbd: validate SID in parent security descriptor during ACL inheritance", " - smb: client: require net admin for CIFS SWN netlink", " - smb: client: use data_len for SMB2 READ encrypted folioq copy", " - mm/memory_hotplug: fix memory block reference leak on remove", " - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer", " - cgroup/cpuset: Reset DL migration state on can_attach() failure", " - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()", " - lsm: hold cred_guard_mutex for lsm_set_self_attr()", " - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index", " - ice: restore PTP Rx timestamp config after ethtool set-channels", " - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()", " - ARM: dts: renesas: genmai: Drop superfluous cells", " - ARM: dts: renesas: rskrza1: Drop superfluous cells", " - riscv: mm: Fixup no5lvl failure when vaddr is invalid", " - ALSA: hda: cs35l41: Put ACPI device on missing physical node", " - ice: fix setting RSS VSI hash for E830", " - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().", " - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST", " - netfs: Fix trimming of streaming-write folios in netfs_inval_folio()", " - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes", " gone", " - wifi: ath10k: skip WMI and beacon transmission when device is wedged", " - scsi: sd: Fix return code handling in sd_spinup_disk()", " - ALSA: scarlett2: Add missing error check when initialise Autogain Status", " - btrfs: fix squota accounting during enable generation", " - landlock: Fix TCP handling of short AF_UNSPEC addresses", " - Upstream stable to v6.6.142, v6.12.92", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2025-71289", " - fs/ntfs3: handle attr_set_size() errors when truncating files", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46315", " - io_uring/waitid: clear waitid info before copying it to userspace", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31486", " - hwmon: (pmbus/core) Protect regulator operations with mutex", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-23469", " - drm/imagination: Synchronize interrupts before suspending the GPU", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31560", " - spi: spi-dw-dma: fix print error log when wait finish transaction", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31420", " - bridge: mrp: reject zero test interval to avoid OOM panic", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46275", " - Bluetooth: hci_uart: fix UAFs and race conditions in close and init", " paths", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46170", " - mptcp: pm: ADD_ADDR rtx: free sk if last", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46158", " - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-46242", " - eventpoll: fix ep_remove struct eventpoll / struct file UAF", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-52931", " - batman-adv: tp_meter: avoid use of uninit sender vars", "", " * CVE-2026-52914", " - batman-adv: fix fragment reassembly length accounting", "", " * CVE-2026-46325", " - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE", "", " * CVE-2026-43465", " - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ", "", " * CVE-2026-43198", " - tcp: fix potential race in tcp_v6_syn_recv_sock()", "", " * CVE-2026-43197", " - netconsole: avoid OOB reads, msg is not nul-terminated", "", " * CVE-2026-43083", " - net: ioam6: fix OOB and missing lock", "" ], "package": "linux", "version": "6.8.0-139.139", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162466, 1786013, 2072994, 2159608, 2160302, 2158920, 2139686, 2158462, 2155609, 2142613, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:25:37 +0200" } ], "notes": "linux-modules-6.8.0-139-generic version '6.8.0-139.139' (source package linux version '6.8.0-139.139') was added. linux-modules-6.8.0-139-generic version '6.8.0-139.139' has the same source package name, linux, as removed package linux-modules-6.8.0-138-generic. As such we can use the source package version of the removed package, '6.8.0-138.138', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-image-6.8.0-138-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-6.8.0-138-generic", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 24.04 noble image from release image serial 20260826 to 20260905", "from_series": "noble", "to_series": "noble", "from_serial": "20260826", "to_serial": "20260905", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }