CLSA-2026-1791878869

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1791878869
Upstream
CVE (277)
Published
2026-10-21T23:59:33Z
Modified
2026-10-26T09:43:39Z
Summary
Fix of 274 CVEs
Details
  • CVE-2026-53091
    • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
    • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
  • CVE-2026-93803
    • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
  • CVE-2026-93286
    • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
  • CVE-2026-93280
    • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
  • CVE-2026-93213
    • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
  • CVE-2026-93802
    • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
  • CVE-2026-93206
    • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
  • CVE-2026-97448
    • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
  • CVE-2026-97408
    • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
  • CVE-2026-93268
    • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
  • CVE-2026-93782
    • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
  • CVE-2026-93783
    • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
  • CVE-2026-97455
    • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
  • CVE-2026-93807
    • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
  • CVE-2026-93808
    • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
  • CVE-2026-89938
    • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
  • CVE-2026-89927
    • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
  • CVE-2026-89949
    • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
  • CVE-2026-89912
    • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
  • CVE-2026-89932
    • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
  • CVE-2026-89833
    • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
  • CVE-2026-90045
    • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
  • CVE-2026-89854
    • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
  • CVE-2026-90015
    • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
  • CVE-2026-89979
    • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
  • CVE-2026-89852
    • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
  • CVE-2026-89861
    • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
  • CVE-2026-89859
    • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
  • CVE-2026-90036
    • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
  • CVE-2026-89987
    • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
  • CVE-2026-89799
    • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
  • CVE-2026-90032
    • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
  • CVE-2026-89822
    • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
  • CVE-2026-89929
    • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
  • CVE-2026-89840
    • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
  • CVE-2026-89913
    • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913}
  • CVE-2026-89865
    • scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers {CVE-2026-89865}
  • CVE-2026-90000
    • HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
  • CVE-2026-89972
    • nvme: add missing SRCU grace period in error path {CVE-2026-89972}
  • CVE-2026-90049
    • net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() {CVE-2026-90049}
  • CVE-2026-89856
    • scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856}
  • CVE-2026-90037
    • NFSD: Prevent client use-after-free during close_lru reaping {CVE-2026-90037}
  • CVE-2026-89948
    • batman-adv: bla: fix freeing of claims on meshif deletion {CVE-2026-89948}
  • CVE-2026-90023
    • usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() {CVE-2026-90023}
  • CVE-2026-90020
    • USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020}
  • CVE-2026-89838
    • f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
  • CVE-2026-89848
    • scsi: qla2xxx: Quiesce response IRQ before freeing request queue {CVE-2026-89848}
  • CVE-2026-90017
    • staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() {CVE-2026-90017}
  • CVE-2026-89897
    • media: cec: Serialize exclusive follower delivery {CVE-2026-89897}
  • CVE-2026-89877
    • media: saa7164: fix cleanup on resource allocation failure {CVE-2026-89877}
  • CVE-2026-89952
    • mtd: rawnand: validate ONFI extended parameter page sections {CVE-2026-89952}
  • CVE-2026-90016
    • staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016}
  • CVE-2026-89999
    • HID: wacom: validate report length in wacom_intuos_pro2_bt_irq {CVE-2026-89999}
  • CVE-2026-90044
    • usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044}
  • CVE-2026-90029
    • usb: storage: realtek_cr: fix use-after-free on disconnect {CVE-2026-90029}
  • CVE-2026-89783
    • xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
  • CVE-2026-89778
    • isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
  • CVE-2026-89845
    • scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845}
  • CVE-2026-89946
    • ASoC: cs35l33: drain threaded IRQ before runtime suspend {CVE-2026-89946}
  • CVE-2026-89846
    • scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846}
  • CVE-2026-89965
    • nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965}
  • CVE-2026-89945
    • ASoC: cs35l34: drain threaded IRQ before runtime suspend {CVE-2026-89945}
  • CVE-2026-89953
    • mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953}
  • CVE-2026-89855
    • scsi: qla2xxx: Serialize flash version read in reset handler {CVE-2026-89855}
  • CVE-2026-89936
    • iio: dac: m62332: Fix regulator reference count imbalance {CVE-2026-89936}
  • CVE-2026-90031
    • usb-storage: ene_ub6250: fix race between scan work and probe {CVE-2026-90031}
  • CVE-2026-89901
    • media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref {CVE-2026-89901}
  • CVE-2026-89878
    • media: s2255: check firmware size before reading trailing marker {CVE-2026-89878}
  • CVE-2026-89890
    • media: go7007: defer the ALSA v4l2 put until card release {CVE-2026-89890}
  • CVE-2026-89893
    • media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
  • CVE-2026-89951
    • batman-adv: fix stale receive device on merged fragments {CVE-2026-89951}
  • CVE-2026-90034
    • usb: image: mdc800: change kmalloc() to kzalloc() {CVE-2026-90034}
  • CVE-2026-90033
    • ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
  • CVE-2026-90007
    • scsi: pm8001: Use rollback index when freeing MSI-X vectors {CVE-2026-90007}
  • CVE-2026-90011
    • scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
  • CVE-2026-90013
    • tracing: Take trace_array reference when opening options file {CVE-2026-90013}
  • CVE-2026-89843
    • scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak {CVE-2026-89843}
  • CVE-2026-89982
    • i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982}
  • CVE-2026-89997
    • dm: fix resume-vs-remove race {CVE-2026-89997}
  • CVE-2026-90019
    • usb: gadget: fix null pointer dereference in usb_put_function_instance() {CVE-2026-90019}
  • CVE-2026-89895
    • media: cobalt: Avoid freeing ALSA private data twice {CVE-2026-89895}
  • CVE-2026-89858
    • scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() {CVE-2026-89858}
  • CVE-2026-89864
    • scsi: qla2xxx: Bound i2c->length in I2C bsg handlers {CVE-2026-89864}
  • CVE-2026-89784
    • SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
  • CVE-2026-89789
    • gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
  • CVE-2026-89786
    • ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
  • CVE-2023-54047
    • drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
  • CVE-2025-40146
    • blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
  • CVE-2026-68367
    • usb: gadget: f_tcm: synchronize delayed set_alt with teardown {CVE-2026-68367}
  • CVE-2026-89659
    • NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
  • CVE-2026-80841
    • net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}
  • CVE-2026-80925
    • vlan: fix skb_under_panic and races when toggling HW VLAN offload {CVE-2026-80925}
  • CVE-2026-64557
    • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() {CVE-2026-64557}
  • CVE-2026-72390
    • net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390}
  • CVE-2026-80994
    • net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
  • CVE-2026-74752
    • sctp: validate cookie AUTH state before use {CVE-2026-74752}
  • CVE-2026-68404
    • wifi: cfg80211: use wiphy work for socket owner autodisconnect {CVE-2026-68404}
  • CVE-2026-72413
    • sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
  • CVE-2026-63921
    • ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}
  • CVE-2026-23050
    • pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
  • CVE-2025-68190
    • drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
  • CVE-2026-63933
    • iio: gyro: adis16260: fix division by zero in write_raw {CVE-2026-63933}
  • CVE-2023-54287
    • tty: serial: imx: disable Ageing Timer interrupt request irq {CVE-2023-54287}
  • CVE-2026-63891
    • thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() {CVE-2026-63891}
  • CVE-2024-50076
    • vt: prevent kernel-infoleak in con_font_get() {CVE-2024-50076}
  • CVE-2021-47659
    • drm/plane: Move range check for format_count earlier {CVE-2021-47659}
  • CVE-2026-63983
    • net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
  • CVE-2025-68342
    • can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data {CVE-2025-68342}
  • CVE-2026-63922
    • ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
  • CVE-2023-54007
    • vmci_host: fix a race condition in vmci_host_poll() causing GPF {CVE-2023-54007}
  • CVE-2025-68173
    • ftrace: Fix softlockup in ftrace_module_enable {CVE-2025-68173}
  • CVE-2022-50864
    • nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
  • CVE-2026-63905
    • usbip: vudc: Fix use after free bug in vudc_remove due to race condition {CVE-2026-63905}
  • CVE-2025-40100
    • btrfs: do not assert we found block group item when creating free space tree {CVE-2025-40100}
  • CVE-2025-40333
    • f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
  • CVE-2025-40160
    • xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
  • CVE-2026-63888
    • scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888}
  • CVE-2025-68778
    • btrfs: don't log conflicting inode if it's a dir moved in the current transaction {CVE-2025-68778}
  • CVE-2023-53799
    • crypto: api - Use work queue in crypto_destroy_instance {CVE-2023-53799}
  • CVE-2026-64009
    • xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
  • CVE-2023-54226
    • af_unix: Fix data races around sk->sk_shutdown. {CVE-2023-54226}
  • CVE-2022-50770
    • ocfs2: fix memory leak in ocfs2_mount_volume() {CVE-2022-50770}
  • CVE-2022-4994
    • KVM: x86: wean fast IN from emulator_pio_in {CVE-2022-4994}
  • CVE-2024-50135
    • nvme-pci: fix race condition between reset and nvme_dev_disable() {CVE-2024-50135}
  • CVE-2026-64011
    • nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011}
  • CVE-2026-80786
    • fbdev: Wrap user-invoked calls to fb_set_var() in helper {CVE-2026-80786}
  • CVE-2022-50774
    • crypto: qat - fix DMA transfer direction {CVE-2022-50774}
  • CVE-2023-53834
    • iio: adc: ina2xx: avoid NULL pointer dereference on OF device match {CVE-2023-53834}
  • CVE-2026-74444
    • drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
  • CVE-2022-50764
    • ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
  • CVE-2026-80794
    • nfc: nci: fix uninit-value in the RF discover/activated NTF handlers {CVE-2026-80794}
  • CVE-2026-80854
    • usb: gadget: f_tcm: keep port count until LUN teardown completes {CVE-2026-80854}
  • CVE-2026-80576
    • drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
  • CVE-2026-80843
    • xfrm: fix xfrm_state_construct() auth-trunc leak {CVE-2026-80843}
  • CVE-2026-74540
    • Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540}
  • CVE-2026-74510
    • Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
  • CVE-2026-68108
    • drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
  • CVE-2026-74283
    • tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283}
  • CVE-2026-64470
    • Bluetooth: btusb: fix use-after-free on marvell probe failure {CVE-2026-64470}
  • CVE-2026-80783
    • HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() {CVE-2026-80783}
  • CVE-2026-72336
    • Bluetooth: 6lowpan: hold L2CAP conn across debugfs control {CVE-2026-72336}
  • CVE-2026-74637
    • perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
  • CVE-2026-72398
    • sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
  • CVE-2026-72323
    • ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
  • CVE-2026-72084
    • scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
  • CVE-2026-80807
    • nilfs2: reject invalid block index in GC ioctl {CVE-2026-80807}
  • CVE-2026-80890
    • sctp: reject stale cookies with mismatched verification tags {CVE-2026-80890}
  • CVE-2026-80733
    • net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733}
  • CVE-2026-80742
    • af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742}
  • CVE-2026-64550
    • net: qualcomm: rmnet: validate MAP frame length before ingress parsing {CVE-2026-64550}
  • CVE-2026-80828
    • ALSA: usb-audio: Complete cleanup after system-resume errors {CVE-2026-80828}
  • CVE-2026-72047
    • ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit {CVE-2026-72047}
  • CVE-2026-74479
    • net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
  • CVE-2026-80764
    • Bluetooth: hci_event: fix LE list UAF on reset {CVE-2026-80764}
  • CVE-2026-74341
    • wifi: wcn36xx: fix heap overflow from oversized firmware HAL response {CVE-2026-74341}
  • CVE-2026-63826
    • fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
  • CVE-2026-80782
    • HID: magicmouse: do not keep a stale msc->input if no input is claimed {CVE-2026-80782}
  • CVE-2026-80798
    • nfc: llcp: reject PDUs shorter than the LLCP header {CVE-2026-80798}
  • CVE-2026-74649
    • staging: rtl8723bs: fix missing shared-key auth challenge length check {CVE-2026-74649}
  • CVE-2026-68398
    • ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
  • CVE-2026-80907
    • drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
  • CVE-2026-74651
    • staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() {CVE-2026-74651}
  • CVE-2026-72070
    • wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
  • CVE-2026-74580
    • vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
  • CVE-2026-64583
    • usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
  • CVE-2026-72255
    • netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255}
  • CVE-2026-72374
    • afs: Fix callback service message parsers to pass through -EAGAIN {CVE-2026-72374}
  • CVE-2026-68190
    • staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() {CVE-2026-68190}
  • CVE-2026-74689
    • net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
  • CVE-2026-80599
    • batman-adv: dat: ensure accessible eth_hdr proto field {CVE-2026-80599}
  • CVE-2026-74609
    • tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
  • CVE-2026-68414
    • wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
  • CVE-2026-72472
    • nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
  • CVE-2026-80796
    • nfc: nci: add data_len bound checks to activation parameter extractors {CVE-2026-80796}
  • CVE-2026-80864
    • RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp {CVE-2026-80864}
  • CVE-2026-80797
    • nfc: pn533: purge fragmented skbs during cleanup {CVE-2026-80797}
  • CVE-2026-72085
    • scsi: xen: scsiback: Free unsubmitted command instead of double-putting it {CVE-2026-72085}
  • CVE-2026-74436
    • rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436}
  • CVE-2026-64582
    • RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582}
  • CVE-2026-74641
    • ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
  • CVE-2026-74744
    • ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
  • CVE-2026-74282
    • tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
  • CVE-2026-80800
    • nfc: llcp: bound the connect_sn TLV walk to the skb {CVE-2026-80800}
  • CVE-2026-74730
    • NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
  • CVE-2026-80863
    • RDMA/rxe: Fix OOB in free_rd_atomic_resources() {CVE-2026-80863}
  • CVE-2026-68198
    • wifi: ath6kl: fix use-after-free in aggr_reset_state() {CVE-2026-68198}
  • CVE-2026-74550
    • net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
  • CVE-2026-80785
    • fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
  • CVE-2026-80755
    • selinux: reject a permission value exceeding the class permission count {CVE-2026-80755}
  • CVE-2026-68155
    • libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
  • CVE-2026-68160
    • ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
  • CVE-2026-74628
    • net/x25: fix use-after-free of the socket by its timers {CVE-2026-74628}
  • CVE-2026-74569
    • netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
  • CVE-2026-74289
    • ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289}
  • CVE-2026-80908
    • drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
  • CVE-2026-74359
    • configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
  • CVE-2026-72322
    • ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
  • CVE-2026-74350
    • ocfs2: validate fast symlink target during inode read {CVE-2026-74350}
  • CVE-2026-80812
    • ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
  • CVE-2026-68142
    • geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
  • CVE-2026-72383
    • sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
  • CVE-2026-80824
    • usb: usbfs: fix use-after-free of usb_device in usbdev_release() {CVE-2026-80824}
  • CVE-2026-74387
    • ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
  • CVE-2026-80847
    • tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847}
  • CVE-2026-80570
    • Input: synaptics-rmi4 - zero report size on F54 work error {CVE-2026-80570}
  • CVE-2026-72476
    • dmaengine: Fix possible use after free {CVE-2026-72476}
  • CVE-2026-89476
    • sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476}
  • CVE-2026-89574
    • dm array: validate array block headers on read {CVE-2026-89574}
  • CVE-2026-89545
    • sunrpc: defer rq_argp and rq_resp free until after RCU grace period {CVE-2026-89545}
  • CVE-2026-89462
    • power: supply: max17040: propagate register read errors {CVE-2026-89462}
  • CVE-2026-89733
    • usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() {CVE-2026-89733}
  • CVE-2026-89484
    • lockd: fix NULL dereference on lockowner allocation failure {CVE-2026-89484}
  • CVE-2026-80996
    • net: l2tp: do not propagate multicast notification errors {CVE-2026-80996}
  • CVE-2026-89656
    • libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656}
  • CVE-2026-89531
    • svcrdma: Reject connection when transport allocation fails {CVE-2026-89531}
  • CVE-2026-89441
    • mmc: via-sdmmc: cancel card-detect work on remove {CVE-2026-89441}
  • CVE-2026-89537
    • SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537}
  • CVE-2026-80976
    • seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976}
  • CVE-2026-89553
    • nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
  • CVE-2026-89492
    • ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492}
  • CVE-2026-80974
    • mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974}
  • CVE-2026-89550
    • SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
  • CVE-2026-89542
    • SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
  • CVE-2026-64014
    • Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size {CVE-2026-64014}
  • CVE-2026-63916
    • HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
  • CVE-2026-63892
    • thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow {CVE-2026-63892}
  • CVE-2026-64010
    • nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() {CVE-2026-64010}
  • CVE-2026-63954
    • hpfs: fix a crash if hpfs_map_dnode_bitmap fails {CVE-2026-63954}
  • CVE-2026-63927
    • usb: dwc2: Fix use after free in debug code {CVE-2026-63927}
  • CVE-2026-63893
    • thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() {CVE-2026-63893}
  • CVE-2026-63915
    • nfc: hci: fix out-of-bounds read in HCP header parsing {CVE-2026-63915}
  • CVE-2026-63904
    • usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
  • CVE-2026-63957
    • USB: serial: safe_serial: fix memory corruption with small endpoint {CVE-2026-63957}
  • CVE-2025-68750
    • usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
  • CVE-2023-54150
    • drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
  • CVE-2026-63908
    • Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem {CVE-2026-63908}
  • CVE-2026-63934
    • iio: gyro: itg3200: fix i2c read into the wrong stack location {CVE-2026-63934}
  • CVE-2026-80819
    • Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept {CVE-2026-80819}
  • CVE-2026-72234
    • batman-adv: access unicast_ttvn skb->data only after skb realloc {CVE-2026-72234}
  • CVE-2026-68357
    • watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() {CVE-2026-68357}
  • CVE-2026-74588
    • sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
  • CVE-2026-68373
    • wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() {CVE-2026-68373}
  • CVE-2026-74556
    • scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
  • CVE-2026-64483
    • ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
  • CVE-2026-63814
    • f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814}
  • CVE-2026-64505
    • usb: gadget: function: rndis: add length check for header {CVE-2026-64505}
  • CVE-2026-72233
    • batman-adv: bla: reacquire gw address after skb realloc {CVE-2026-72233}
  • CVE-2026-80801
    • nfc: microread: validate target discovery payload lengths {CVE-2026-80801}
  • CVE-2026-68121
    • pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
  • CVE-2026-74597
    • ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
  • CVE-2026-80752
    • Input: psxpad-spi - set driver data before use {CVE-2026-80752}
  • CVE-2026-89555
    • mpls: reload header after pskb_may_pull() {CVE-2026-89555}
  • CVE-2026-89504
    • regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer {CVE-2026-89504}
  • CVE-2026-81001
    • slip: fix use-after-free in sl_sync() {CVE-2026-81001}
  • CVE-2026-89569
    • Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569}
  • CVE-2026-89539
    • SUNRPC: reject duplicate CREDS_VALUE options {CVE-2026-89539}
  • CVE-2026-89761
    • apparmor: fix out-of-bounds write when null terminating a label vec {CVE-2026-89761}
  • CVE-2026-89494
    • ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494}
  • CVE-2026-89548
    • SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
  • CVE-2026-89478
    • sctp: drop a chunk if its transport was removed {CVE-2026-89478}
  • CVE-2026-89487
    • openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}
  • CVE-2026-89477
    • sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
  • CVE-2026-89495
    • ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495}
  • CVE-2026-89729
    • HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}
  • CVE-2026-89742
    • rapidio: mport_cdev: fix use-after-free in dma_req_free() {CVE-2026-89742}
  • CVE-2026-89607
    • ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607}
  • CVE-2026-80918
    • HID: core: fix number/pointer type confusion on long items {CVE-2026-80918}
  • CVE-2026-64372
    • cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
  • CVE-2026-64423
    • ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
  • CVE-2026-64323
    • udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
  • CVE-2026-64322
    • udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
  • CVE-2026-64452
    • 6lowpan: fix NHC entry use-after-free on error path {CVE-2026-64452}
  • CVE-2026-64351
    • net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351}
  • CVE-2026-64343
    • USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
  • CVE-2026-64318
    • partitions: aix: bound the pp_count scan to the ppe array {CVE-2026-64318}
  • CVE-2026-46208
    • batman-adv: correct the del_timer_sync() rationale in batadv_tp_stop_all() {CVE-2026-46208}
  • CVE-2023-53039
    • HID: intel-ish-hid: ipc: set dev->devc before the first dev_err() {CVE-2023-53039}
  • Miscellaneous upstream changes
    • driver core: generalize driver_override in struct device
  • Bump ABI 4.15.0-266
References

Affected packages

TuxCare:Ubuntu:16.04
linux-buildinfo-4.15.0-266-generic

Package

Name
linux-buildinfo-4.15.0-266-generic
Purl
pkg:deb/tuxcare/linux-buildinfo-4.15.0-266-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-buildinfo-4.15.0-266-lowlatency

Package

Name
linux-buildinfo-4.15.0-266-lowlatency
Purl
pkg:deb/tuxcare/linux-buildinfo-4.15.0-266-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-cloud-tools-4.15.0-266-generic

Package

Name
linux-cloud-tools-4.15.0-266-generic
Purl
pkg:deb/tuxcare/linux-cloud-tools-4.15.0-266-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-cloud-tools-4.15.0-266-lowlatency

Package

Name
linux-cloud-tools-4.15.0-266-lowlatency
Purl
pkg:deb/tuxcare/linux-cloud-tools-4.15.0-266-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-headers-4.15.0-266

Package

Name
linux-headers-4.15.0-266
Purl
pkg:deb/tuxcare/linux-headers-4.15.0-266?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-headers-4.15.0-266-generic

Package

Name
linux-headers-4.15.0-266-generic
Purl
pkg:deb/tuxcare/linux-headers-4.15.0-266-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-headers-4.15.0-266-lowlatency

Package

Name
linux-headers-4.15.0-266-lowlatency
Purl
pkg:deb/tuxcare/linux-headers-4.15.0-266-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-hwe-cloud-tools-4.15.0-266

Package

Name
linux-hwe-cloud-tools-4.15.0-266
Purl
pkg:deb/tuxcare/linux-hwe-cloud-tools-4.15.0-266?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-hwe-tools-4.15.0-266

Package

Name
linux-hwe-tools-4.15.0-266
Purl
pkg:deb/tuxcare/linux-hwe-tools-4.15.0-266?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-image-unsigned-4.15.0-266-generic

Package

Name
linux-image-unsigned-4.15.0-266-generic
Purl
pkg:deb/tuxcare/linux-image-unsigned-4.15.0-266-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-image-unsigned-4.15.0-266-lowlatency

Package

Name
linux-image-unsigned-4.15.0-266-lowlatency
Purl
pkg:deb/tuxcare/linux-image-unsigned-4.15.0-266-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-modules-4.15.0-266-generic

Package

Name
linux-modules-4.15.0-266-generic
Purl
pkg:deb/tuxcare/linux-modules-4.15.0-266-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-modules-4.15.0-266-lowlatency

Package

Name
linux-modules-4.15.0-266-lowlatency
Purl
pkg:deb/tuxcare/linux-modules-4.15.0-266-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-modules-extra-4.15.0-266-generic

Package

Name
linux-modules-extra-4.15.0-266-generic
Purl
pkg:deb/tuxcare/linux-modules-extra-4.15.0-266-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-source-4.15.0

Package

Name
linux-source-4.15.0
Purl
pkg:deb/tuxcare/linux-source-4.15.0?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-tools-4.15.0-266-generic

Package

Name
linux-tools-4.15.0-266-generic
Purl
pkg:deb/tuxcare/linux-tools-4.15.0-266-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"
linux-tools-4.15.0-266-lowlatency

Package

Name
linux-tools-4.15.0-266-lowlatency
Purl
pkg:deb/tuxcare/linux-tools-4.15.0-266-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.15.0-266.277~16.04.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791878869.json"