Ubuntu Security Advisories

It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-66070) It was discovered that RabbitMQ Server incorrectly handled TLS peer-certificate DNs in the management UI. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2026-66077) It was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays with zero-width element constructors. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-66079) It was discovered that RabbitMQ Server trust-store plugin incorrectly validated client certificates. An attacker could possibly use this issue to bypass TLS client authentication. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67231) It was discovered that RabbitMQ Server incorrectly handled WebSocket frame sizes. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67232) It was discovered that RabbitMQ Server incorrectly handled content-header body sizes. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-67235) It was discovered that RabbitMQ Server incorrectly stored credentials in an insecure cookie. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67236) It was discovered that RabbitMQ Server incorrectly handled OAuth bearer tokens in bootstrap JavaScript. An attacker could possibly use this issue to cause a cross-site scripting attack. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-67237) It was discovered that RabbitMQ Server incorrectly handled ETF-encoded PID node names. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67238) It was discovered that RabbitMQ Server incorrectly handled TLS peer-certificate DNs in the stream management UI. An attacker could possibly use this issue to cause a cross-site scripting attack. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67239) It was discovered that RabbitMQ Server incorrectly handled OAuth2 SSL options when no CA certificates were available. An attacker could possibly use this issue to bypass TLS verification. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-67404) It was discovered that RabbitMQ Server incorrectly validated HTTP response status codes when fetching JWKS keys. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67409)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - S390 architecture; - IIO ADC drivers; - Multiple devices driver; - PCI subsystem; - VFIO drivers; - Network file system (NFS) server daemon; - Overlay file system; - IPv6 networking; - Netfilter; (CVE-2024-53194, CVE-2024-53214, CVE-2024-56570, CVE-2024-56779, CVE-2024-57849, CVE-2024-57904, CVE-2024-57929, CVE-2025-21664, CVE-2025-38724, CVE-2026-53131, CVE-2026-53221)

USN-8883-1 fixed a vulnerability in Go versions 1.18, 1.21, and 1.24. This update provides the corresponding fix for Go version 1.23. Original advisory details: It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly use this issue to bypass hostname-based access controls and escalate privileges.

Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-86409) Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414) Stanislav Fort discovered that curl did not correctly handle HSTS entries when an includeSubDomains parent entry was imported before a longer-lived child entry. An attacker could possibly use this issue to cause curl to use unencrypted HTTP connections. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-87862) Stanislav Fort discovered that curl did not properly handle HSTS max-age values that exceeded calendar time structure bounds. An attacker could possibly use this issue to cause a denial of service or data loss. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-87863) Stanislav Fort discovered that curl did not properly handle IMAP APPEND commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be interpreted as pipelined commands. An authenticated attacker could possibly use this issue to inject arbitrary IMAP commands. (CVE-2026-87864) Joshua Rogers discovered that libcurl had a use-after-free vulnerability in the FTP wildcard matching code. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-92388) Joshua Rogers discovered that libcurl's TFTP state machine did not properly validate transfer directions, allowing a malicious server to force the client into transmit mode. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-92389) Joshua Rogers discovered that curl had a stack overflow vulnerability when processing deeply nested MIME structures. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-92391) Joshua Rogers discovered that libcurl could expose credentials in the URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved from a .netrc file. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-94266)

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-58415) Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote attacker could possibly use this issue to make a forward proxy connect to an arbitrary host. (CVE-2026-63045) Hyojae Lee and Zhen Kong discovered that Apache HTTP Server incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-63292) Lucian Nitescu and Zhen Kong discovered that Apache HTTP Server did not properly handle certain responses from backend servers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-63686) Qing Xu discovered that Apache HTTP Server incorrectly interpreted HTTP responses from backend servers. A remote attacker could possibly use this issue to perform HTTP response smuggling attacks. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63718) Hyojae Lee discovered that Apache HTTP Server did not properly validate Digest authentication requests. A machine-in-the-middle attacker could possibly use this issue to bypass authentication. (CVE-2026-73636) Zhen Kong and Darren Carreras discovered that Apache HTTP Server did not properly manage authentication requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-73637) Vlatko Kosturjak discovered that Apache HTTP Server did not properly enforce access restrictions for user directories. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-79768) Zhen Kong discovered that Apache HTTP Server did not properly handle certain WebDAV requests. An authenticated user could possibly use this issue to cause a denial of service or corrupt WebDAV property data. (CVE-2026-93546)

Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74222) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did not properly validate certain DHCPv6 option lengths during network boot. An attacker could possibly use this issue to trigger out-of-bounds memory access, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74225)

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677) Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778) Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519) It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723) It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-10822) It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11331) It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11622) It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-11721) It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13204) It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13321) It was discovered that Bind incorrectly served zone transfer data before verifying the TSIG signature on multi-message transfers. A remote attacker could possibly use this issue to send unauthorized zone contents to a secondary server. (CVE-2026-19033) It was discovered that Bind incorrectly handled the lifetime of cached DNSSEC proofs, leading to a use-after-free. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19662) It was discovered that Bind incorrectly handled certain malformed answers when configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-19666) It was discovered that Bind incorrectly handled oversized negative answers when storing them in the negative cache. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19667) It was discovered that Bind incorrectly handled large numbers of certain invalid DNSSEC records during validation. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19668) It was discovered that Bind incorrectly accepted inapplicable NSEC records as proof that no wildcard existed. A remote attacker could possibly use this issue to forge NXDOMAIN responses, masking the existence of wildcard records. (CVE-2026-19941) It was discovered that Bind incorrectly handled repeated copies of records that should only appear once, such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. (CVE-2026-75029) It was discovered that Bind incorrectly handled TKEY queries when the configuration did not contain a global options block. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-76163) It was discovered that Bind incorrectly accepted NSEC3 records from unrelated sibling zones as proof of an insecure delegation. A remote attacker could possibly use this issue to bypass DNSSEC validation and inject forged unsigned answers. (CVE-2026-77119) It was discovered that Bind incorrectly handled DNS-over-HTTPS requests containing invalid SIG(0) records when the connection was closed prematurely. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-77692) It was discovered that Bind incorrectly treated NS or DNAME records above the zone origin as zone cuts. An attacker could possibly use this issue to cause Bind to serve or cache out-of-zone data, resulting in cache poisoning. (CVE-2026-78301) It was discovered that Bind incorrectly handled wildcard answers with both NSEC3 and NSEC proofs at the same owner name. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-80274) It was discovered that Bind incorrectly released resources when processing SVCB and HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-81563) It was discovered that Bind incorrectly limited additional processing for cached SVCB and HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-81736)

It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a recursive copy operation. A remote attacker controlling the server could possibly use this issue to write files to unintended locations. (CVE-2026-106552) It was discovered that OpenSSH's sshd server incorrectly handled GSSAPIAuthentication state across authentication attempts. An attacker could possibly use this issue to obtain credentials from a previous failed authentication attempt. (CVE-2026-106553, CVE-2026-106555) It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder during compression. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-106582) It was discovered that OpenSSH's ssh client incorrectly allowed special characters in command-line usernames. An attacker could possibly use this issue to inject arbitrary commands via specially crafted usernames. (CVE-2026-106583) It was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight Saving Time when converting dates. An attacker could possibly use this issue to cause certificates to have incorrect expiration times. (CVE-2026-106584) It was discovered that OpenSSH did not check whether the maximum packet length was exceeded during decompression. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-106585) It was discovered that OpenSSH's sshd server incorrectly applied the restrict keyword from authorized_keys to tunnel forwarding requests. A local attacker with an authorized key could possibly use this issue to bypass intended tunnel forwarding restrictions. (CVE-2026-106586) It was discovered that OpenSSH's sshd server incorrectly handled certain configuration options that accept a "none" value. An attacker could possibly use this issue to cause OpenSSH to behave unexpectedly. (CVE-2026-106587)

It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928) Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPT_INTERFACE was used. An attacker could possibly use this issue to cause connections to go out from an unintended source address. (CVE-2026-107929) Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86409) Stanislav Fort discovered that the curl command line tool did not set SSH host verification options when following redirects to SFTP or SCP URLs. An attacker could possibly use this issue to perform machine-in-the-middle attacks. (CVE-2026-86410) Stanislav Fort discovered that curl did not properly handle cookie jar entries that could not be reloaded. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-86412) Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414) Stanislav Fort discovered that curl did not correctly handle HSTS entries when an includeSubDomains parent entry was imported before a longer-lived child entry. An attacker could possibly use this issue to cause curl to use unencrypted HTTP connections. (CVE-2026-87862) Stanislav Fort discovered that curl did not properly handle HSTS max-age values that exceeded calendar time structure bounds. An attacker could possibly use this issue to cause a denial of service or data loss. (CVE-2026-87863) Stanislav Fort discovered that curl did not properly handle IMAP APPEND commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be interpreted as pipelined commands. An authenticated attacker could possibly use this issue to inject arbitrary IMAP commands. (CVE-2026-87864) Bobbeh Rhino discovered that libcurl, when used with libssh2 and a hashed known_hosts file, could misreport a host key mismatch as a missing key. An attacker could possibly use this issue to perform machine-in-the-middle attacks. (CVE-2026-87865) Joshua Rogers discovered that curl did not properly handle long cookie entries written to a Netscape cookie jar. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-92386) Joshua Rogers discovered that a malicious FTP, IMAP, POP3, or SMTP server could cause libcurl to block indefinitely by omitting the final control-response line. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-92387) Joshua Rogers discovered that libcurl had a use-after-free vulnerability in the FTP wildcard matching code. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-92388) Joshua Rogers discovered that libcurl's TFTP state machine did not properly validate transfer directions, allowing a malicious server to force the client into transmit mode. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-92389) Joshua Rogers discovered that curl did not properly enforce its file overwrite protection when using --remote-header-name in certain circumstances. An attacker could possibly use this issue to overwrite local files. (CVE-2026-92390) Joshua Rogers discovered that curl had a stack overflow vulnerability when processing deeply nested MIME structures. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. (CVE-2026-92391) Joshua Rogers discovered that libcurl could expose credentials in the URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved from a .netrc file. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-94266) Joshua Rogers discovered that libcurl had a use-after-free vulnerability during HTTP/2 uploads when handling RST_STREAM responses from the server. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-92392)

Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not correctly handle certain certificate validations. An attacker could possibly use this issue to observe or modify forwarded traffic. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97687) Martin Desrumaux discovered that urllib3 did not correctly handle decoding certain deflate responses. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97688) It was discovered that urllib3 did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-97689)

Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285) It was discovered that YAML-LibYAML did not correctly handle parsing certain documents. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-25777) It was discovered that YAML-LibYAML contained a regular expression susceptible to catastrophic backtracking. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2026-63676)

USN-8908-1 fixed vulnerabilities in BlueZ. Unfortunately, that update introduced a regression in the A2DP profile: cached remote stream endpoints were no longer loaded at startup, which could cause Bluetooth audio devices to fail to reconnect automatically or to fall back to low-quality audio profiles. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Michael Bommarito discovered that BlueZ incorrectly handled codec capability storage in the A2DP profile. An attacker could possibly use this issue to cause a stack buffer overflow, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-19774) It was discovered that BlueZ incorrectly handled packet length validation. An attacker could possibly use this issue to read out of bounds memory, causing a crash or exposing sensitive information. (CVE-2026-75032) It was discovered that BlueZ incorrectly handled crafted XML input. An attacker could possibly use this issue to crash BlueZ, resulting in a denial of service. (CVE-2026-80185) It was discovered that BlueZ incorrectly parsed remote names from Extended Inquiry Response data. An attacker could possibly use this issue to cause a stack buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-80186) Alexandro Calo discovered that BlueZ incorrectly parsed certain responses in the AVRCP profile. An attacker could possibly use this issue to access out of bounds memory, causing a crash or exposing sensitive information. (CVE-2026-85218)

It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. (CVE-2017-5967) Wen Xu discovered that the XFS file system implementation in the Linux kernel did not properly track inode validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13093) Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13097, CVE-2018-13100) It was discovered that the Qualcomm Atheros 60GHz wireless driver in the Linux kernel contained an integer overflow when validating the length of certain information elements, leading to a buffer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5848) Likang Luo discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3752) It was discovered that the eventpoll (aka epoll) implementation in the Linux kernel did not properly handle certain error conditions when adding file descriptors, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-39634) Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083) Lyu Tao discovered that the NFS implementation in the Linux kernel did not properly handle requests to open a directory on a regular file. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-24448) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - IPv6 networking; - Netfilter; (CVE-2026-53131)

It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - NVDIMM (Non-Volatile Memory Device) drivers; - Handshake API; - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Intel NPU Driver; - ACPI drivers; - Android drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Bluetooth drivers; - Cdrom driver; - Character device driver; - Hardware random number generator core; - TPM device driver; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - DAX dirext access to differentiated memory framework; - Buffer Sharing and Synchronization framework; - DMA engine subsystem; - FireWire subsystem; - Arm Firmware Framework for ARMv8-A(FFA); - ARM SCMI message protocol; - Intel Stratix 10 firmware drivers; - FPGA Framework; - GPIO subsystem; - GPU drivers; - HID subsystem; - Microsoft Hyper-V drivers; - Hardware monitoring drivers; - CoreSight HW tracing drivers; - Intel Trace Hub HW tracing drivers; - I2C subsystem; - IIO subsystem; - IIO ADC drivers; - IIO Magnetometer sensors drivers; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Mouse) drivers; - IOMMU subsystem; - IRQ chip drivers; - LED subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MemoryStick subsystem; - Multifunction device drivers; - Intel Management Engine Interface driver; - Amazon Nitro Secure Module driver; - MMC subsystem; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - MediaTek network drivers; - NTB driver; - NVME drivers; - PCI subsystem; - x86 platform drivers; - i.MX PM domains; - System reset/shutdown drivers; - Power supply drivers; - RapidIO drivers; - Voltage and Current Regulator drivers; - Remote Processor subsystem; - Reset controller framework; - RPMSG subsystem; - Real Time Clock drivers; - S/390 drivers; - SCSI subsystem; - Xilinx SoC drivers; - SPI subsystem; - Media staging drivers; - Media Oriented Systems Transport (MOST) driver; - NVIDIA Tegra embedded controller (NVEC) staging driver; - Realtek RTL8723BS SDIO drivers; - VME bus staging drivers; - TCM subsystem; - TTY drivers; - USB DSL drivers; - Cadence USB3 driver; - ULPI bus; - USB core drivers; - DesignWare USB3 driver; - Faraday FOTG210 USB2 dual-role controller driver; - USB Gadget drivers; - USB Host Controller drivers; - USB ChaosKey driver; - Siemens ID Mouse USB driver; - IOWarrior USB driver; - LD Didactic USB driver; - LEGO USB Tower driver; - USS720 USB parallel port adapter driver; - MediaTek USB3 DRD driver; - USB Dual Role (OTG-ready) Controller drivers; - USB Serial drivers; - USB Type-C Port Controller Manager driver; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - vDPA drivers; - VFIO drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - Watchdog drivers; - Xen hypervisor drivers; - 9P distributed file system; - AFS file system; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - exFAT file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS file system; - HFS+ file system; - Journaling layer for block devices (JBD2); - Network file system (NFS) client; - Network file system (NFS) server daemon; - NILFS2 file system; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - SMB network file system; - UDF file system; - XFS file system; - Key management; - BPF subsystem; - Memory management; - File system encryption (fscrypt); - Software nodes and device properties; - Glob pattern matching library; - IPv4 networking; - KVM subsystem; - Mellanox drivers; - Socket messages infrastructure; - Sun RPC protocol; - Memory Management; - Media input infrastructure; - IPv6 networking; - Bluetooth subsystem; - Wireless networking; - Networking core; - IP tunnels definitions; - Netfilter; - SCTP protocol; - Network sockets; - Network traffic control; - XFRM subsystem; - io_uring subsystem; - Audit subsystem; - Control group (cgroup); - Kernel CPU control infrastructure; - Perf events; - Kernel exit() syscall; - Kernel fork() syscall; - Locking primitives; - Kernel module support; - Scheduler infrastructure; - Signal handling mechanism; - Timer subsystem; - Tracing infrastructure; - Debug objects infrastructure; - 6LoWPAN network protocol; - 9P file system network protocol; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - CAN network layer; - Ceph Core library; - HSR network protocol; - IEEE802154.4 network protocol; - IFE protocol; - IUCV driver; - KCM (Kernel Connection Multiplexor) sockets driver; - Logical Link layer; - MAC80211 subsystem; - IEEE 802.15.4 subsystem; - MultiProtocol Label Switching driver; - Open vSwitch; - Packet sockets; - Phonet protocol; - Packet sampling (psample); - Qualcomm IPC Router (QRTR); - RDS protocol; - RxRPC session sockets; - SMC sockets; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - X.25 network layer; - AppArmor security module; - Linux Security Modules (LSM) Framework; - Integrity Measurement Architecture(IMA) framework; - SELinux security module; - Apple Onboard Audio ALSA driver; - ALSA framework; - FireWire sound drivers; - HD-audio driver; - Gravis UltraSound ALSA driver; - C-Media CMI8x38 ALSA driver; - ESS Solo-1 ALSA driver; - ICE1712/ICE1724 (Envy24) ALSA driver; - Yamaha YMFPCI ALSA driver; - Texas InstrumentS Audio (ASoC/HDA) drivers; - SoC Audio for Freescale CPUs drivers; - MediaTek ASoC drivers; - QCOM ASoC drivers; - SOF drivers; - NVIDIA Tegra ASoC drivers; - USB sound devices; (CVE-2024-56552, CVE-2025-21687, CVE-2025-21985, CVE-2025-23131, CVE-2025-38069, CVE-2025-38187, CVE-2025-38563, CVE-2025-38565, CVE-2025-40014, CVE-2025-40098, CVE-2026-43010, CVE-2026-43216, CVE-2026-45897, CVE-2026-45901, CVE-2026-45944, CVE-2026-46140, CVE-2026-46252, CVE-2026-52909, CVE-2026-52928, CVE-2026-53005, CVE-2026-53027, CVE-2026-53070, CVE-2026-53078, CVE-2026-53090, CVE-2026-53157, CVE-2026-53163, CVE-2026-53167, CVE-2026-53226, CVE-2026-53325, CVE-2026-53327, CVE-2026-53361, CVE-2026-53362, CVE-2026-53365, CVE-2026-53366, CVE-2026-53381, CVE-2026-53382, CVE-2026-53383, CVE-2026-53384, CVE-2026-53385, CVE-2026-53387, CVE-2026-53388, CVE-2026-53389, CVE-2026-53390, CVE-2026-53391, CVE-2026-53392, CVE-2026-53393, CVE-2026-53397, CVE-2026-53398, CVE-2026-53399, CVE-2026-53400, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794, CVE-2026-63795, CVE-2026-63796, CVE-2026-63797, CVE-2026-63798, CVE-2026-63800, CVE-2026-63801, CVE-2026-63802, CVE-2026-63803, CVE-2026-63804, CVE-2026-63806, CVE-2026-63807, CVE-2026-63808, CVE-2026-63809, CVE-2026-63810, CVE-2026-63812, CVE-2026-63814, CVE-2026-63815, CVE-2026-63816, CVE-2026-63817, CVE-2026-63818, CVE-2026-63821, CVE-2026-63822, CVE-2026-63823, CVE-2026-63824, CVE-2026-63826, CVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830, CVE-2026-63831, CVE-2026-63833, CVE-2026-63834, CVE-2026-63835, CVE-2026-63836, CVE-2026-63940, CVE-2026-63970, CVE-2026-64187, CVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64192, CVE-2026-64205, CVE-2026-64206, CVE-2026-64241, CVE-2026-64244, CVE-2026-64245, CVE-2026-64246, CVE-2026-64247, CVE-2026-64249, CVE-2026-64254, CVE-2026-64256, CVE-2026-64266, CVE-2026-64268, CVE-2026-64269, CVE-2026-64270, CVE-2026-64271, CVE-2026-64272, CVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276, CVE-2026-64277, CVE-2026-64279, CVE-2026-64280, CVE-2026-64286, CVE-2026-64287, CVE-2026-64289, CVE-2026-64294, CVE-2026-64296, CVE-2026-64297, CVE-2026-64298, CVE-2026-64299, CVE-2026-64301, CVE-2026-64303, CVE-2026-64304, CVE-2026-64305, CVE-2026-64306, CVE-2026-64312, CVE-2026-64313, CVE-2026-64315, CVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64319, CVE-2026-64320, CVE-2026-64321, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64326, CVE-2026-64329, CVE-2026-64330, CVE-2026-64331, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334, CVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338, CVE-2026-64340, CVE-2026-64341, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344, CVE-2026-64345, CVE-2026-64346, CVE-2026-64347, CVE-2026-64348, CVE-2026-64350, CVE-2026-64351, CVE-2026-64352, CVE-2026-64355, CVE-2026-64358, CVE-2026-64359, CVE-2026-64360, CVE-2026-64361, CVE-2026-64362, CVE-2026-64363, CVE-2026-64364, CVE-2026-64365, CVE-2026-64368, CVE-2026-64369, CVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373, CVE-2026-64374, CVE-2026-64375, CVE-2026-64376, CVE-2026-64377, CVE-2026-64378, CVE-2026-64379, CVE-2026-64380, CVE-2026-64381, CVE-2026-64382, CVE-2026-64383, CVE-2026-64384, CVE-2026-64385, CVE-2026-64386, CVE-2026-64387, CVE-2026-64390, CVE-2026-64391, CVE-2026-64392, CVE-2026-64393, CVE-2026-64394, CVE-2026-64395, CVE-2026-64396, CVE-2026-64397, CVE-2026-64398, CVE-2026-64399, CVE-2026-64401, CVE-2026-64402, CVE-2026-64403, CVE-2026-64404, CVE-2026-64405, CVE-2026-64406, CVE-2026-64407, CVE-2026-64408, CVE-2026-64409, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413, CVE-2026-64417, CVE-2026-64418, CVE-2026-64419, CVE-2026-64420, CVE-2026-64421, CVE-2026-64422, CVE-2026-64423, CVE-2026-64424, CVE-2026-64425, CVE-2026-64428, CVE-2026-64429, CVE-2026-64430, CVE-2026-64432, CVE-2026-64433, CVE-2026-64434, CVE-2026-64435, CVE-2026-64436, CVE-2026-64437, CVE-2026-64438, CVE-2026-64440, CVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444, CVE-2026-64445, CVE-2026-64446, CVE-2026-64448, CVE-2026-64449, CVE-2026-64450, CVE-2026-64452, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456, CVE-2026-64458, CVE-2026-64461, CVE-2026-64462, CVE-2026-64463, CVE-2026-64465, CVE-2026-64468, CVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64472, CVE-2026-64473, CVE-2026-64474, CVE-2026-64475, CVE-2026-64476, CVE-2026-64478, CVE-2026-64479, CVE-2026-64480, CVE-2026-64481, CVE-2026-64482, CVE-2026-64483, CVE-2026-64484, CVE-2026-64486, CVE-2026-64487, CVE-2026-64488, CVE-2026-64489, CVE-2026-64493, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496, CVE-2026-64497, CVE-2026-64500, CVE-2026-64503, CVE-2026-64504, CVE-2026-64505, CVE-2026-64507, CVE-2026-64508, CVE-2026-64510, CVE-2026-64511, CVE-2026-64512, CVE-2026-64514, CVE-2026-64530, CVE-2026-64532, CVE-2026-64533, CVE-2026-64534, CVE-2026-64535, CVE-2026-64536, CVE-2026-64537, CVE-2026-64538, CVE-2026-64539, CVE-2026-64540, CVE-2026-64541, CVE-2026-64542, CVE-2026-64543, CVE-2026-64544, CVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64548, CVE-2026-64549, CVE-2026-64550, CVE-2026-64551, CVE-2026-64552, CVE-2026-64553, CVE-2026-64554, CVE-2026-64555, CVE-2026-64556, CVE-2026-64557, CVE-2026-64560, CVE-2026-64561, CVE-2026-64562, CVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64568, CVE-2026-64569, CVE-2026-64570, CVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64574, CVE-2026-64576, CVE-2026-64577, CVE-2026-64578, CVE-2026-64579, CVE-2026-64580, CVE-2026-64582, CVE-2026-64583, CVE-2026-64584, CVE-2026-64585, CVE-2026-64590, CVE-2026-64593, CVE-2026-64594, CVE-2026-64597, CVE-2026-64598, CVE-2026-64599, CVE-2026-64600, CVE-2026-64602, CVE-2026-64603, CVE-2026-64604, CVE-2026-68083, CVE-2026-68084, CVE-2026-68085, CVE-2026-68088, CVE-2026-68090, CVE-2026-68091, CVE-2026-68093, CVE-2026-68096, CVE-2026-68097, CVE-2026-68098, CVE-2026-68099, CVE-2026-68100, CVE-2026-68104, CVE-2026-68106, CVE-2026-68107, CVE-2026-68108, CVE-2026-68110, CVE-2026-68111, CVE-2026-68112, CVE-2026-68115, CVE-2026-68116, CVE-2026-68117, CVE-2026-68119, CVE-2026-68121, CVE-2026-68123, CVE-2026-68124, CVE-2026-68125, CVE-2026-68126, CVE-2026-68127, CVE-2026-68129, CVE-2026-68130, CVE-2026-68131, CVE-2026-68135, CVE-2026-68136, CVE-2026-68137, CVE-2026-68139, CVE-2026-68140, CVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68144, CVE-2026-68145, CVE-2026-68146, CVE-2026-68147, CVE-2026-68148, CVE-2026-68149, CVE-2026-68151, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155, CVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68160, CVE-2026-68161, CVE-2026-68162, CVE-2026-68164, CVE-2026-68165, CVE-2026-68175, CVE-2026-68176, CVE-2026-68178, CVE-2026-68179, CVE-2026-68180, CVE-2026-68181, CVE-2026-68182, CVE-2026-68183, CVE-2026-68184, CVE-2026-68186, CVE-2026-68187, CVE-2026-68188, CVE-2026-68189, CVE-2026-68190, CVE-2026-68192, CVE-2026-68193, CVE-2026-68194, CVE-2026-68195, CVE-2026-68196, CVE-2026-68197, CVE-2026-68199, CVE-2026-68202, CVE-2026-68203, CVE-2026-68204, CVE-2026-68205, CVE-2026-68206, CVE-2026-68207, CVE-2026-68209, CVE-2026-68210, CVE-2026-68212, CVE-2026-68213, CVE-2026-68214, CVE-2026-68215, CVE-2026-68216, CVE-2026-68217, CVE-2026-68218, CVE-2026-68219, CVE-2026-68220, CVE-2026-68221, CVE-2026-68222, CVE-2026-68223, CVE-2026-68225, CVE-2026-68226, CVE-2026-68227, CVE-2026-68228, CVE-2026-68229, CVE-2026-68231, CVE-2026-68234, CVE-2026-68235, CVE-2026-68236, CVE-2026-68243, CVE-2026-68244, CVE-2026-68246, CVE-2026-68247, CVE-2026-68248, CVE-2026-68249, CVE-2026-68250, CVE-2026-68251, CVE-2026-68255, CVE-2026-68256, CVE-2026-68259, CVE-2026-68260, CVE-2026-68261, CVE-2026-68262, CVE-2026-68263, CVE-2026-68269, CVE-2026-68271, CVE-2026-68272, CVE-2026-68277, CVE-2026-68278, CVE-2026-68279, CVE-2026-68280, CVE-2026-68281, CVE-2026-68284, CVE-2026-68290, CVE-2026-68293, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299, CVE-2026-68300, CVE-2026-68301, CVE-2026-68302, CVE-2026-68304, CVE-2026-68306, CVE-2026-68308, CVE-2026-68309, CVE-2026-68310, CVE-2026-68313, CVE-2026-68314, CVE-2026-68315, CVE-2026-68317, CVE-2026-68318, CVE-2026-68319, CVE-2026-68320, CVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327, CVE-2026-68328, CVE-2026-68329, CVE-2026-68331, CVE-2026-68333, CVE-2026-68335, CVE-2026-68336, CVE-2026-68338, CVE-2026-68339, CVE-2026-68340, CVE-2026-68343, CVE-2026-68346, CVE-2026-68348, CVE-2026-68349, CVE-2026-68350, CVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354, CVE-2026-68355, CVE-2026-68357, CVE-2026-68359, CVE-2026-68360, CVE-2026-68361, CVE-2026-68362, CVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68368, CVE-2026-68369, CVE-2026-68370, CVE-2026-68371, CVE-2026-68372, CVE-2026-68373, CVE-2026-68376, CVE-2026-68377, CVE-2026-68381, CVE-2026-68386, CVE-2026-68388, CVE-2026-68389, CVE-2026-68391, CVE-2026-68392, CVE-2026-68395, CVE-2026-68396, CVE-2026-68397, CVE-2026-68398, CVE-2026-68399, CVE-2026-68402, CVE-2026-68403, CVE-2026-68405, CVE-2026-68406, CVE-2026-68407, CVE-2026-68408, CVE-2026-68410, CVE-2026-68411, CVE-2026-68413, CVE-2026-68414, CVE-2026-68416, CVE-2026-68417, CVE-2026-68419, CVE-2026-68422, CVE-2026-68425, CVE-2026-68427, CVE-2026-68428, CVE-2026-68429, CVE-2026-68430, CVE-2026-68432, CVE-2026-68433, CVE-2026-68437, CVE-2026-68439, CVE-2026-68442, CVE-2026-68443, CVE-2026-68444, CVE-2026-68445, CVE-2026-68446, CVE-2026-68449, CVE-2026-68450, CVE-2026-68454, CVE-2026-68456, CVE-2026-68457, CVE-2026-68459, CVE-2026-68460, CVE-2026-68461, CVE-2026-68466, CVE-2026-68467, CVE-2026-68469, CVE-2026-68474, CVE-2026-68475, CVE-2026-68476, CVE-2026-68477, CVE-2026-68478, CVE-2026-68479, CVE-2026-72004, CVE-2026-72005, CVE-2026-72007, CVE-2026-72010, CVE-2026-72012, CVE-2026-72013, CVE-2026-72014, CVE-2026-72015, CVE-2026-72017, CVE-2026-72019, CVE-2026-72020, CVE-2026-72021, CVE-2026-72022, CVE-2026-72023, CVE-2026-72024, CVE-2026-72025, CVE-2026-72028, CVE-2026-72029, CVE-2026-72030, CVE-2026-72033, CVE-2026-72035, CVE-2026-72036, CVE-2026-72037, CVE-2026-72038, CVE-2026-72039, CVE-2026-72040, CVE-2026-72041, CVE-2026-72045, CVE-2026-72047, CVE-2026-72048, CVE-2026-72049, CVE-2026-72051, CVE-2026-72052, CVE-2026-72053, CVE-2026-72054, CVE-2026-72055, CVE-2026-72056, CVE-2026-72057, CVE-2026-72058, CVE-2026-72059, CVE-2026-72061, CVE-2026-72062, CVE-2026-72063, CVE-2026-72066, CVE-2026-72067, CVE-2026-72068, CVE-2026-72069, CVE-2026-72070, CVE-2026-72071, CVE-2026-72072, CVE-2026-72074, CVE-2026-72075, CVE-2026-72076, CVE-2026-72077, CVE-2026-72078, CVE-2026-72079, CVE-2026-72081, CVE-2026-72082, CVE-2026-72083, CVE-2026-72084, CVE-2026-72085, CVE-2026-72086, CVE-2026-72087, CVE-2026-72088, CVE-2026-72089, CVE-2026-72096, CVE-2026-72097, CVE-2026-72099, CVE-2026-72102, CVE-2026-72105, CVE-2026-72106, CVE-2026-72107, CVE-2026-72108, CVE-2026-72109, CVE-2026-72110, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115, CVE-2026-72116, CVE-2026-72117, CVE-2026-72118, CVE-2026-72119, CVE-2026-72120, CVE-2026-72121, CVE-2026-72122, CVE-2026-72123, CVE-2026-72124, CVE-2026-72125, CVE-2026-72126, CVE-2026-72127, CVE-2026-72129, CVE-2026-72130, CVE-2026-72132, CVE-2026-72133, CVE-2026-72135, CVE-2026-72136, CVE-2026-72138, CVE-2026-72140, CVE-2026-72142, CVE-2026-72144, CVE-2026-72146, CVE-2026-72147, CVE-2026-72148, CVE-2026-72149, CVE-2026-72152, CVE-2026-72153, CVE-2026-72155, CVE-2026-72156, CVE-2026-72157, CVE-2026-72158, CVE-2026-72159, CVE-2026-72160, CVE-2026-72161, CVE-2026-72163, CVE-2026-72164, CVE-2026-72165, CVE-2026-72166, CVE-2026-72167, CVE-2026-72168, CVE-2026-72170, CVE-2026-72171, CVE-2026-72172, CVE-2026-72174, CVE-2026-72175, CVE-2026-72176, CVE-2026-72177, CVE-2026-72179, CVE-2026-72181, CVE-2026-72182, CVE-2026-72191, CVE-2026-72192, CVE-2026-72193, CVE-2026-72194, CVE-2026-72195, CVE-2026-72196, CVE-2026-72197, CVE-2026-72212, CVE-2026-72213, CVE-2026-72214, CVE-2026-72215, CVE-2026-72216, CVE-2026-72217, CVE-2026-72218, CVE-2026-72219, CVE-2026-72221, CVE-2026-72222, CVE-2026-72223, CVE-2026-72224, CVE-2026-72225, CVE-2026-72226, CVE-2026-72227, CVE-2026-72228, CVE-2026-72229, CVE-2026-72230, CVE-2026-72231, CVE-2026-72232, CVE-2026-72233, CVE-2026-72234, CVE-2026-72235, CVE-2026-72236, CVE-2026-72237, CVE-2026-72238, CVE-2026-72240, CVE-2026-72241, CVE-2026-72242, CVE-2026-72243, CVE-2026-72244, CVE-2026-72245, CVE-2026-72247, CVE-2026-72250, CVE-2026-72251, CVE-2026-72252, CVE-2026-72253, CVE-2026-72254, CVE-2026-72255, CVE-2026-72256, CVE-2026-72257, CVE-2026-72258, CVE-2026-72259, CVE-2026-72260, CVE-2026-72261, CVE-2026-72262, CVE-2026-72264, CVE-2026-72265, CVE-2026-72266, CVE-2026-72267, CVE-2026-72268, CVE-2026-72269, CVE-2026-72270, CVE-2026-72271, CVE-2026-72272, CVE-2026-72273, CVE-2026-72274, CVE-2026-72275, CVE-2026-72276, CVE-2026-72282, CVE-2026-72284, CVE-2026-72289, CVE-2026-72290, CVE-2026-72296, CVE-2026-72297, CVE-2026-72298, CVE-2026-72299, CVE-2026-72300, CVE-2026-72301, CVE-2026-72302, CVE-2026-72304, CVE-2026-72305, CVE-2026-72306, CVE-2026-72307, CVE-2026-72308, CVE-2026-72310, CVE-2026-72312, CVE-2026-72314, CVE-2026-72316, CVE-2026-72317, CVE-2026-72318, CVE-2026-72319, CVE-2026-72320, CVE-2026-72322, CVE-2026-72323, CVE-2026-72324, CVE-2026-72325, CVE-2026-72326, CVE-2026-72327, CVE-2026-72330, CVE-2026-72335, CVE-2026-72336, CVE-2026-72338, CVE-2026-72339, CVE-2026-72340, CVE-2026-72342, CVE-2026-72343, CVE-2026-72347, CVE-2026-72348, CVE-2026-72349, CVE-2026-72350, CVE-2026-72351, CVE-2026-72352, CVE-2026-72361, CVE-2026-72362, CVE-2026-72369, CVE-2026-72371, CVE-2026-72373, CVE-2026-72374, CVE-2026-72376, CVE-2026-72378, CVE-2026-72379, CVE-2026-72382, CVE-2026-72384, CVE-2026-72389, CVE-2026-72390, CVE-2026-72391, CVE-2026-72392, CVE-2026-72395, CVE-2026-72396, CVE-2026-72399, CVE-2026-72400, CVE-2026-72405, CVE-2026-72406, CVE-2026-72409, CVE-2026-72410, CVE-2026-72414, CVE-2026-72416, CVE-2026-72418, CVE-2026-72419, CVE-2026-72420, CVE-2026-72421, CVE-2026-72422, CVE-2026-72424, CVE-2026-72425, CVE-2026-72427, CVE-2026-72428, CVE-2026-72430, CVE-2026-72433, CVE-2026-72434, CVE-2026-72435, CVE-2026-72436, CVE-2026-72437, CVE-2026-72441, CVE-2026-72443, CVE-2026-72444, CVE-2026-72447, CVE-2026-72448, CVE-2026-72449, CVE-2026-72450, CVE-2026-72451, CVE-2026-72459, CVE-2026-72460, CVE-2026-72464, CVE-2026-72466, CVE-2026-72467, CVE-2026-72469, CVE-2026-72470, CVE-2026-72473, CVE-2026-72474, CVE-2026-72476, CVE-2026-72478, CVE-2026-72479, CVE-2026-72480, CVE-2026-72481, CVE-2026-72483, CVE-2026-72484, CVE-2026-72486, CVE-2026-72487, CVE-2026-72489, CVE-2026-72491, CVE-2026-72492, CVE-2026-72502, CVE-2026-74255, CVE-2026-74256, CVE-2026-74262, CVE-2026-74263, CVE-2026-74265, CVE-2026-74267, CVE-2026-74270, CVE-2026-74271, CVE-2026-74276, CVE-2026-74278, CVE-2026-74279, CVE-2026-74280, CVE-2026-74281, CVE-2026-74282, CVE-2026-74283, CVE-2026-74284, CVE-2026-74287, CVE-2026-74288, CVE-2026-74290, CVE-2026-74292, CVE-2026-74293, CVE-2026-74295, CVE-2026-74296, CVE-2026-74297, CVE-2026-74300, CVE-2026-74302, CVE-2026-74303, CVE-2026-74305, CVE-2026-74307, CVE-2026-74308, CVE-2026-74310, CVE-2026-74312, CVE-2026-74313, CVE-2026-74318, CVE-2026-74320, CVE-2026-74321, CVE-2026-74327, CVE-2026-74329, CVE-2026-74330, CVE-2026-74331, CVE-2026-74339, CVE-2026-74340, CVE-2026-74341, CVE-2026-74345, CVE-2026-74346, CVE-2026-74348, CVE-2026-74349, CVE-2026-74351, CVE-2026-74356, CVE-2026-74359, CVE-2026-74362, CVE-2026-74363, CVE-2026-74365, CVE-2026-74376, CVE-2026-74377, CVE-2026-74378, CVE-2026-74379, CVE-2026-74380, CVE-2026-74381, CVE-2026-74382, CVE-2026-74384, CVE-2026-74386, CVE-2026-74387, CVE-2026-74389, CVE-2026-74390, CVE-2026-74391, CVE-2026-74394, CVE-2026-74395, CVE-2026-74397, CVE-2026-74398, CVE-2026-74399, CVE-2026-74401, CVE-2026-74402, CVE-2026-74406, CVE-2026-74408, CVE-2026-74410, CVE-2026-74411, CVE-2026-74416, CVE-2026-74417, CVE-2026-74424, CVE-2026-74426, CVE-2026-74427, CVE-2026-74432, CVE-2026-74435, CVE-2026-74436, CVE-2026-74438, CVE-2026-74439, CVE-2026-74584, CVE-2026-80591, CVE-2026-80593, CVE-2026-80594, CVE-2026-80595, CVE-2026-80597, CVE-2026-80598, CVE-2026-80599, CVE-2026-80600, CVE-2026-80601, CVE-2026-80602, CVE-2026-80603, CVE-2026-80605, CVE-2026-80609, CVE-2026-80611, CVE-2026-80613, CVE-2026-80618, CVE-2026-80619, CVE-2026-80620, CVE-2026-80622, CVE-2026-80624, CVE-2026-80626, CVE-2026-80627, CVE-2026-80629, CVE-2026-80630, CVE-2026-80635, CVE-2026-80636, CVE-2026-80637, CVE-2026-80644, CVE-2026-80645, CVE-2026-80646, CVE-2026-80647, CVE-2026-80649, CVE-2026-80650, CVE-2026-80652, CVE-2026-80654, CVE-2026-80659, CVE-2026-80660, CVE-2026-80663, CVE-2026-80664, CVE-2026-80667, CVE-2026-80669, CVE-2026-80676, CVE-2026-80677, CVE-2026-80865, CVE-2026-80867, CVE-2026-80870, CVE-2026-80875, CVE-2026-80876, CVE-2026-80877, CVE-2026-80879, CVE-2026-80880, CVE-2026-80881, CVE-2026-80883, CVE-2026-80886, CVE-2026-89460, CVE-2026-89774)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - S390 architecture; - IIO ADC drivers; - Multiple devices driver; - PCI subsystem; - VFIO drivers; - Network file system (NFS) server daemon; - Overlay file system; (CVE-2024-53194, CVE-2024-53214, CVE-2024-56570, CVE-2024-56779, CVE-2024-57849, CVE-2024-57904, CVE-2024-57929, CVE-2025-21664)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Ethernet bonding driver; - Network drivers; - F2FS file system; - Network file system (NFS) server daemon; - Tracing infrastructure; - io_uring subsystem; - Networking core; - IPv6 networking; - IUCV driver; - Netfilter; - RxRPC session sockets; (CVE-2022-49149, CVE-2022-49170, CVE-2022-49182, CVE-2022-49201, CVE-2024-53187, CVE-2024-53210, CVE-2024-56763, CVE-2025-38724, CVE-2026-43456, CVE-2026-52910, CVE-2026-53131, CVE-2026-53221)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SCSI subsystem; - Bluetooth subsystem; (CVE-2022-49111, CVE-2022-49114)

It was discovered that Sudo did not properly handle time-based access restrictions when sudoers rules used NOTBEFORE or NOTAFTER with timestamps omitting the trailing timezone indicator. A local attacker could possibly use this issue to execute commands outside the intended time window by manipulating the TZ environment variable.

It was discovered that Poppler had an integer overflow in FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-102620) It was discovered that Poppler had an integer overflow in SplashClip::clipToPath. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-102621) It was discovered that Poppler had a null pointer dereference in JBIG2Stream. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service. (CVE-2026-93312) It was discovered that Poppler had an integer overflow in JBIG2Stream::readCodeTableSeg. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93313) It was discovered that Poppler had an integer overflow in FoFiTrueType::mapCodeToGID. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93314)

It was discovered that libwebsockets did not properly validate user-supplied data when parsing HTTP/2 HPACK path headers, which could result in a write past the end of an allocated buffer. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-19773) It was discovered that libwebsockets did not properly handle CBOR recording in the LECP parser, which could result in a write past the end of an allocated buffer. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2026-78161)