CLSA-2026-1792980237

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1792980237
Upstream
CVE (277)
Published
2026-10-26T02:08:48Z
Modified
2026-10-26T09:43:38Z
Summary
Fix of 276 CVEs
Details
  • CVE-2022-49416
    • wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
  • CVE-2022-49685
    • iio: trigger: sysfs: fix use-after-free on remove {CVE-2022-49685}
  • CVE-2021-47670
    • can: peak_usb: fix use after free bugs {CVE-2021-47670}
  • CVE-2026-98706
    • wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
  • CVE-2026-98610
    • net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
  • CVE-2026-98548
    • sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
  • CVE-2026-98614
    • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
  • CVE-2026-98547
    • af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
  • CVE-2026-98579
    • nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure {CVE-2026-98579}
  • CVE-2026-98581
    • nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() {CVE-2026-98581}
  • CVE-2026-98577
    • nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
  • CVE-2026-98482
    • nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
  • CVE-2026-98576
    • nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
  • CVE-2026-98624
    • netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
    • netlink: use blocking notifier {CVE-2026-98624}
  • CVE-2026-98794
    • ipvs: filter some flags received in the backup server {CVE-2026-98794}
  • CVE-2026-98829
    • wifi: mac80211: drop oversized fragments to avoid extra_len overflow {CVE-2026-98829}
  • CVE-2026-98708
    • wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708}
  • CVE-2026-98707
    • wifi: mac80211: shut down RX BA session timer on teardown {CVE-2026-98707}
  • CVE-2026-98532
    • ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
  • CVE-2026-98541
    • fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
  • CVE-2026-98461
    • Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461}
  • CVE-2026-98621
    • net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
  • CVE-2026-98526
    • llc: reserve device headroom for allocated frames {CVE-2026-98526}
  • CVE-2026-98555
    • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
  • CVE-2026-98573
    • net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
  • CVE-2026-98739
    • Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}
  • CVE-2026-98457
    • Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
  • CVE-2026-98460
    • Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
  • CVE-2026-98856
    • kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856}
  • CVE-2026-98636
    • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
  • CVE-2026-98681
    • smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681}
  • CVE-2026-98771
    • usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
  • CVE-2026-98772
    • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
  • CVE-2026-98696
    • USB: serial: fix driver deregistration order {CVE-2026-98696}
  • CVE-2026-98697
    • USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
  • CVE-2026-98769
    • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
  • CVE-2026-98764
    • usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764}
  • CVE-2026-98763
    • usb: core: clear both ep_in and ep_out for non-ep0 control endpoints {CVE-2026-98763}
  • CVE-2026-98753
    • tty: tty_port: restore TTY_IO_ERROR on activation failure {CVE-2026-98753}
  • CVE-2026-98582
    • nfc: st21nfca: validate received frame size {CVE-2026-98582}
  • CVE-2026-98578
    • nfc: st21nfca: validate ISO15693 inventory length {CVE-2026-98578}
  • CVE-2026-98481
    • nfc: port100: reject frames whose declared length exceeds the received data {CVE-2026-98481}
  • CVE-2026-98583
    • nfc: nfcmrvl: validate helper command length before pull {CVE-2026-98583}
  • CVE-2026-98710
    • wifi: iwlegacy: 3945: free EEPROM data on remove {CVE-2026-98710}
  • CVE-2026-98612
    • net: usb: catc: bound the RX packet length in catc_rx_done() {CVE-2026-98612}
  • CVE-2026-98594
    • tg3: clean up PHYLIB resources on probe failure {CVE-2026-98594}
  • CVE-2026-98494
    • net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}
  • CVE-2026-98488
    • net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488}
  • CVE-2026-98489
    • net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489}
  • CVE-2026-98722
    • mtd: block2mtd: Fix divide error when erase_size is zero {CVE-2026-98722}
  • CVE-2026-98662
    • iio: light: gp2ap020a00f: drain irq_work after free_irq {CVE-2026-98662}
  • CVE-2026-98608
    • drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() {CVE-2026-98608}
  • CVE-2026-98609
    • drm/virtio: fix object leak when drm_gem_handle_create() fails {CVE-2026-98609}
  • CVE-2026-98623
    • drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update {CVE-2026-98623}
  • CVE-2026-98511
    • drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() {CVE-2026-98511}
  • CVE-2026-98732
    • Bluetooth: btintel: fix buffer over-read in btintel_hw_error() {CVE-2026-98732}
  • CVE-2026-98819
    • Bluetooth: btintel: validate DDC record lengths {CVE-2026-98819}
  • CVE-2026-63806
    • KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() {CVE-2026-63806}
  • CVE-2026-53004
    • sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
  • CVE-2026-53157
    • net: phonet: free phonet_device after RCU grace period {CVE-2026-53157}
  • CVE-2026-46267
    • nfc: hci: shdlc: Stop timers and work before freeing context {CVE-2026-46267}
  • CVE-2026-98425
    • wifi: mac80211: don't warn when an IBSS has no channel to scan {CVE-2026-98425}
  • CVE-2026-98406
    • wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver {CVE-2026-98406}
  • CVE-2023-53821
    • ip6_vti: fix slab-use-after-free in decode_session6 {CVE-2023-53821}
  • CVE-2023-53705
    • ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-53705}
  • CVE-2026-98393
    • net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393}
  • CVE-2025-68283
    • libceph: replace BUG_ON with bounds check for map->max_osd {CVE-2025-68283}
  • CVE-2026-43407
    • libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407}
  • CVE-2025-68799
    • caif: fix integer underflow in cffrml_receive() {CVE-2025-68799}
  • CVE-2025-40271
    • fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
  • CVE-2025-68767
    • hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
  • CVE-2025-40351
    • hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() {CVE-2025-40351}
  • CVE-2023-53804
    • nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() {CVE-2023-53804}
  • CVE-2023-54127
    • fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() {CVE-2023-54127}
  • CVE-2022-50747
    • hfs: Fix OOB Write in hfs_asc2mac {CVE-2022-50747}
  • CVE-2023-53862
    • hfs: fix missing hfs_bnode_get() in __hfs_bnode_create {CVE-2023-53862}
  • CVE-2026-63796
    • ocfs2: reject oversized group bitmap descriptors {CVE-2026-63796}
  • CVE-2025-68771
    • ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
  • CVE-2025-40055
    • ocfs2: fix double free in user_cluster_connect() {CVE-2025-40055}
  • CVE-2023-54187
    • f2fs: fix potential corruption when moving a directory {CVE-2023-54187}
  • CVE-2026-45920
    • ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
  • CVE-2026-46191
    • fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191}
  • CVE-2026-53195
    • USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
  • CVE-2022-50732
    • staging: rtl8192u: Fix use after free in ieee80211_rx() {CVE-2022-50732}
  • CVE-2023-54284
    • media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284}
  • CVE-2026-98386
    • scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot {CVE-2026-98386}
  • CVE-2022-50656
    • nfc: pn533: Clear nfc_target before being used {CVE-2022-50656}
  • CVE-2026-46069
    • wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
  • CVE-2023-54286
    • wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace {CVE-2023-54286}
  • CVE-2026-46163
    • wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163}
  • CVE-2026-46122
    • wifi: b43: enforce bounds check on firmware key index in b43_rx() {CVE-2026-46122}
  • CVE-2025-68724
    • crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
  • CVE-2025-40106
    • comedi: fix divide-by-zero in comedi_buf_munge() {CVE-2025-40106}
  • CVE-2026-46022
    • misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() {CVE-2026-46022}
  • CVE-2026-46064
    • ibmasm: fix heap over-read in ibmasm_send_i2o_message() {CVE-2026-46064}
  • CVE-2026-45994
    • ibmasm: fix OOB reads in command_file_write due to missing size checks {CVE-2026-45994}
  • CVE-2023-53800
    • ubi: Fix use-after-free when volume resizing failed {CVE-2023-53800}
  • CVE-2026-46294
    • dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
  • CVE-2023-52515
    • RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
  • CVE-2025-68330
    • iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
  • CVE-2025-68797
    • char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
  • CVE-2026-90116
    • ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
  • CVE-2026-80599
    • batman-adv: dat: ensure accessible eth_hdr proto field {CVE-2026-80599}
  • CVE-2026-74341
    • wifi: wcn36xx: fix heap overflow from oversized firmware HAL response {CVE-2026-74341}
  • CVE-2026-72083
    • scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083}
  • CVE-2023-53839
    • dccp: fix data-race around dp->dccps_mss_cache {CVE-2023-53839}
  • CVE-2026-80890
    • sctp: reject stale cookies with mismatched verification tags {CVE-2026-80890}
  • CVE-2026-68365
    • USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
  • CVE-2019-12456
    • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
  • CVE-2025-39863
    • wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
  • CVE-2025-38483
    • comedi: das16m1: Fix bit shift out of bounds {CVE-2025-38483}
  • CVE-2026-64015
    • security/keys: fix missed RCU read section on lookup {CVE-2026-64015}
  • CVE-2026-43250
    • usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() {CVE-2026-43250}
  • CVE-2026-43281
    • mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281}
  • CVE-2026-23060
    • crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
  • CVE-2025-39817
    • efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
  • CVE-2025-38180
    • net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
  • CVE-2026-23235
    • f2fs: fix out-of-bounds access in sysfs attribute read/write {CVE-2026-23235}
  • CVE-2026-52923
    • ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
  • CVE-2025-39797
    • xfrm: Duplicate SPI Handling {CVE-2025-39797}
  • CVE-2025-38401
    • mtk-sd: Prevent memory corruption from DMA map failure {CVE-2025-38401}
  • CVE-2022-49834
    • nilfs2: fix use-after-free bug of ns_writer on remount {CVE-2022-49834}
  • CVE-2025-38230
    • jfs: validate AG parameters in dbMount() to prevent crashes {CVE-2025-38230}
  • CVE-2026-98312
    • ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312}
  • CVE-2026-98269
    • btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269}
  • CVE-2025-38685
    • fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
  • CVE-2026-98222
    • KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222}
  • CVE-2026-98185
    • wifi: mwifiex: validate scan response extents {CVE-2026-98185}
  • CVE-2026-93287
    • i2c: smbus: reject oversized block transfers in the common path {CVE-2026-93287}
  • CVE-2026-93781
    • scsi: core: Do not block on tag allocation in scsi_eh_lock_door() {CVE-2026-93781}
  • CVE-2026-93231
    • lockd: fix swapped arguments in nlmsvc_match_ip() {CVE-2026-93231}
  • CVE-2026-80841
    • net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}
  • CVE-2026-97938
    • reboot: fix cad_pid use-after-free race {CVE-2026-97938}
  • CVE-2026-93286
    • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
  • CVE-2026-93206
    • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
  • CVE-2026-97448
    • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
  • CVE-2026-97408
    • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
  • CVE-2026-90207
    • ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
  • CVE-2026-93056
    • usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
  • CVE-2026-80907
    • drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
  • CVE-2026-89492
    • ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492}
  • CVE-2022-50864
    • nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
  • CVE-2026-89838
    • f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
  • CVE-2026-89666
    • nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops {CVE-2026-89666}
  • CVE-2024-50289
    • media: av7110: fix a spectre vulnerability {CVE-2024-50289}
  • CVE-2023-53728
    • posix-timers: Ensure timer ID search-loop limit is valid {CVE-2023-53728}
  • CVE-2026-89952
    • mtd: rawnand: validate ONFI extended parameter page sections {CVE-2026-89952}
  • CVE-2025-68343
    • can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header {CVE-2025-68343}
  • CVE-2026-80783
    • HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() {CVE-2026-80783}
  • CVE-2026-90245
    • fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245}
  • CVE-2026-93140
    • udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
  • CVE-2022-50764
    • ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
  • CVE-2026-90235
    • sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
  • CVE-2026-90105
    • vxlan: fix reading neigh ha {CVE-2026-90105}
  • CVE-2026-92499
    • ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
  • CVE-2023-54226
    • af_unix: Fix data races around sk->sk_shutdown. {CVE-2023-54226}
  • CVE-2026-80807
    • nilfs2: reject invalid block index in GC ioctl {CVE-2026-80807}
  • CVE-2025-40160
    • xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
  • CVE-2026-90234
    • NFS: Return a delegation the client fails to record {CVE-2026-90234}
  • CVE-2023-53799
    • crypto: api - Use work queue in crypto_destroy_instance {CVE-2023-53799}
  • CVE-2026-80947
    • wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop {CVE-2026-80947}
  • CVE-2022-50868
    • hwrng: amd - Fix PCI device refcount leak {CVE-2022-50868}
  • CVE-2026-90418
    • nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch {CVE-2026-90418}
  • CVE-2026-93053
    • speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053}
  • CVE-2026-80847
    • tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847}
  • CVE-2026-90314
    • remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() {CVE-2026-90314}
  • CVE-2026-80996
    • net: l2tp: do not propagate multicast notification errors {CVE-2026-80996}
  • CVE-2026-89531
    • svcrdma: Reject connection when transport allocation fails {CVE-2026-89531}
  • CVE-2026-63916
    • HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
  • CVE-2026-80828
    • ALSA: usb-audio: Complete cleanup after system-resume errors {CVE-2026-80828}
  • CVE-2026-89552
    • params: fix charp corruption on allocation failure {CVE-2026-89552}
  • CVE-2023-53796
    • f2fs: fix information leak in f2fs_move_inline_dirents() {CVE-2023-53796}
  • CVE-2026-80854
    • usb: gadget: f_tcm: keep port count until LUN teardown completes {CVE-2026-80854}
  • CVE-2023-54180
    • btrfs: handle case when repair happens with dev-replace {CVE-2023-54180}
  • CVE-2026-80861
    • usb: xhci: bail out of setup if the controller is inaccessible {CVE-2026-80861}
  • CVE-2026-90138
    • vsock: don't check the listener's sk_err in vsock_accept() {CVE-2026-90138}
  • CVE-2026-90141
    • ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141}
  • CVE-2026-89948
    • batman-adv: bla: fix freeing of claims on meshif deletion {CVE-2026-89948}
  • CVE-2026-80800
    • nfc: llcp: bound the connect_sn TLV walk to the skb {CVE-2026-80800}
  • CVE-2022-50660
    • wifi: ipw2200: fix memory leak in ipw_wdev_init() {CVE-2022-50660}
  • CVE-2022-50857
    • rapidio: rio: fix possible name leak in rio_register_mport() {CVE-2022-50857}
  • CVE-2023-53808
    • wifi: mwifiex: fix memory leak in mwifiex_histogram_read() {CVE-2023-53808}
  • CVE-2022-50821
    • SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails {CVE-2022-50821}
  • CVE-2026-80875
    • ipvs: use parsed transport offset in TCP state lookup {CVE-2026-80875}
  • CVE-2026-90109
    • net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue {CVE-2026-90109}
  • CVE-2026-90058
    • net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058}
  • CVE-2026-93188
    • HID: roccat: bound device-supplied profile index {CVE-2026-93188}
  • CVE-2026-89949
    • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
  • CVE-2026-89877
    • media: saa7164: fix cleanup on resource allocation failure {CVE-2026-89877}
  • CVE-2023-54007
    • vmci_host: fix a race condition in vmci_host_poll() causing GPF {CVE-2023-54007}
  • CVE-2023-53853
    • netlink: annotate accesses to nlk->cb_running {CVE-2023-53853}
  • CVE-2026-90053
    • net/sched: sch_htb: limit htb_classify inner-class filter hops {CVE-2026-90053}
  • CVE-2026-90075
    • net/sched: fq_codel: clamp default quantum and mtu {CVE-2026-90075}
  • CVE-2026-90076
    • net/sched: fq: add overflow bounds to quantum and initial quantum {CVE-2026-90076}
  • CVE-2025-40333
    • f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
  • CVE-2026-90415
    • RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
  • CVE-2026-90126
    • rtc: pcf8563: fix clock provider leak on unbind {CVE-2026-90126}
  • CVE-2026-90073
    • net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073}
  • CVE-2026-90420
    • nilfs2: fix infinite loop in nilfs_clean_segments() {CVE-2026-90420}
  • CVE-2026-90216
    • ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216}
  • CVE-2026-89845
    • scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845}
  • CVE-2026-89951
    • batman-adv: fix stale receive device on merged fragments {CVE-2026-89951}
  • CVE-2025-68190
    • drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
  • CVE-2025-68750
    • usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
  • CVE-2023-53802
    • wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function {CVE-2023-53802}
  • CVE-2026-80908
    • drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
  • CVE-2026-89441
    • mmc: via-sdmmc: cancel card-detect work on remove {CVE-2026-89441}
  • CVE-2026-80948
    • wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
  • CVE-2026-90020
    • USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020}
  • CVE-2023-54134
    • autofs: fix memory leak of waitqueues in autofs_catatonic_mode {CVE-2023-54134}
  • CVE-2023-54311
    • ext4: fix deadlock when converting an inline directory in nojournal mode {CVE-2023-54311}
  • CVE-2026-80755
    • selinux: reject a permission value exceeding the class permission count {CVE-2026-80755}
  • CVE-2026-89484
    • lockd: fix NULL dereference on lockowner allocation failure {CVE-2026-89484}
  • CVE-2026-80843
    • xfrm: fix xfrm_state_construct() auth-trunc leak {CVE-2026-80843}
  • CVE-2026-80764
    • Bluetooth: hci_event: fix LE list UAF on reset {CVE-2026-80764}
  • CVE-2026-80974
    • mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974}
  • CVE-2026-89468
    • power: supply: lp8788-charger: fix use-after-free on remove {CVE-2026-89468}
  • CVE-2026-90395
    • power: supply: isp1704_charger: cancel work on remove {CVE-2026-90395}
  • CVE-2026-90049
    • net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() {CVE-2026-90049}
  • CVE-2026-64448
    • smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
  • CVE-2026-74550
    • net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
  • CVE-2026-89861
    • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
  • CVE-2026-90225
    • nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225}
  • CVE-2026-89569
    • Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569}
  • CVE-2026-90327
    • phonet: pep: do not write beyond optlen in getsockopt {CVE-2026-90327}
  • CVE-2026-90419
    • nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419}
  • CVE-2026-90283
    • hugetlbfs: release subpool on fill_super failure {CVE-2026-90283}
  • CVE-2026-92521
    • ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521}
  • CVE-2026-93108
    • RDMA/ipoib: Drain RCU callbacks during module teardown {CVE-2026-93108}
  • CVE-2026-90307
    • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
  • CVE-2026-90226
    • nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226}
  • CVE-2026-90151
    • NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151}
  • CVE-2026-92522
    • ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522}
  • CVE-2026-90112
    • net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
  • CVE-2026-89846
    • scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846}
  • CVE-2026-89953
    • mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953}
  • CVE-2026-89936
    • iio: dac: m62332: Fix regulator reference count imbalance {CVE-2026-89936}
  • CVE-2026-90031
    • usb-storage: ene_ub6250: fix race between scan work and probe {CVE-2026-90031}
  • CVE-2026-89879
    • media: s2255: bound JPEG frame size before copying into the buffer {CVE-2026-89879}
  • CVE-2026-89997
    • dm: fix resume-vs-remove race {CVE-2026-89997}
  • CVE-2026-89858
    • scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() {CVE-2026-89858}
  • CVE-2026-89864
    • scsi: qla2xxx: Bound i2c->length in I2C bsg handlers {CVE-2026-89864}
  • CVE-2023-53788
    • ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() {CVE-2023-53788}
  • CVE-2023-54045
    • audit: fix possible soft lockup in __audit_inode_child() {CVE-2023-54045}
  • CVE-2025-40137
    • f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
  • CVE-2022-50840
    • scsi: snic: Fix possible UAF in snic_tgt_create() {CVE-2022-50840}
  • CVE-2022-50566
    • mtd: Fix device name leak when register device failed in add_mtd_device() {CVE-2022-50566}
  • CVE-2022-50716
    • wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out {CVE-2022-50716}
  • CVE-2026-63954
    • hpfs: fix a crash if hpfs_map_dnode_bitmap fails {CVE-2026-63954}
  • CVE-2026-63915
    • nfc: hci: fix out-of-bounds read in HCP header parsing {CVE-2026-63915}
  • CVE-2023-54087
    • ubi: Fix possible null-ptr-deref in ubi_free_volume() {CVE-2023-54087}
  • CVE-2022-50849
    • pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP {CVE-2022-50849}
  • CVE-2022-50834
    • nfc: Fix potential resource leaks {CVE-2022-50834}
  • CVE-2023-53845
    • nilfs2: fix infinite loop in nilfs_mdt_get_block() {CVE-2023-53845}
  • CVE-2026-63957
    • USB: serial: safe_serial: fix memory corruption with small endpoint {CVE-2026-63957}
  • CVE-2023-53831
    • net: read sk->sk_family once in sk_mc_loop() {CVE-2023-53831}
  • CVE-2022-50876
    • usb: musb: Fix musb_gadget.c rxstate overflow bug {CVE-2022-50876}
  • CVE-2023-54032
    • btrfs: fix race when deleting quota root from the dirty cow roots list {CVE-2023-54032}
  • CVE-2023-54314
    • media: af9005: Fix null-ptr-deref in af9005_i2c_xfer {CVE-2023-54314}
  • CVE-2023-54282
    • media: tuners: qt1010: replace BUG_ON with a regular error {CVE-2023-54282}
  • CVE-2023-54264
    • fs/sysv: Null check to prevent null-ptr-deref bug {CVE-2023-54264}
  • CVE-2026-80819
    • Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept {CVE-2026-80819}
  • CVE-2026-80801
    • nfc: microread: validate target discovery payload lengths {CVE-2026-80801}
  • CVE-2026-74682
    • ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
  • CVE-2026-80765
    • HID: hyperv: validate initial device info bounds {CVE-2026-80765}
  • CVE-2026-80826
    • USB: c67x00: fix use-after-free in c67x00_add_iso_urb() {CVE-2026-80826}
  • CVE-2026-80802
    • nfc: fdp: bound the device-reported read length and fix an skb leak {CVE-2026-80802}
  • CVE-2026-80844
    • xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
  • CVE-2026-80767
    • HID: sensor: custom: Fix use-after-free in enable_sensor {CVE-2026-80767}
  • CVE-2026-80830
    • usb: core: Add lock to usb_wakeup_notification() {CVE-2026-80830}
  • CVE-2026-80876
    • ring-buffer: Fix event length with forced 8-byte alignment {CVE-2026-80876}
  • CVE-2026-80814
    • rndis_host: add overflow check in rndis_rx_fixup() {CVE-2026-80814}
  • CVE-2026-80827
    • USB: serial: option: fix slab OOB read in interrupt URB callback {CVE-2026-80827}
  • CVE-2026-80971
    • ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971}
  • CVE-2026-64095
    • batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
  • CVE-2023-52922
    • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
  • CVE-2026-23076
    • ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
  • Bump ABI 4.4.0-291
References

Affected packages

TuxCare:Ubuntu:16.04
linux-buildinfo-4.4.0-291-generic

Package

Name
linux-buildinfo-4.4.0-291-generic
Purl
pkg:deb/tuxcare/linux-buildinfo-4.4.0-291-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-buildinfo-4.4.0-291-lowlatency

Package

Name
linux-buildinfo-4.4.0-291-lowlatency
Purl
pkg:deb/tuxcare/linux-buildinfo-4.4.0-291-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-cloud-tools-4.4.0-291

Package

Name
linux-cloud-tools-4.4.0-291
Purl
pkg:deb/tuxcare/linux-cloud-tools-4.4.0-291?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-cloud-tools-4.4.0-291-generic

Package

Name
linux-cloud-tools-4.4.0-291-generic
Purl
pkg:deb/tuxcare/linux-cloud-tools-4.4.0-291-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-cloud-tools-4.4.0-291-lowlatency

Package

Name
linux-cloud-tools-4.4.0-291-lowlatency
Purl
pkg:deb/tuxcare/linux-cloud-tools-4.4.0-291-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-cloud-tools-common

Package

Name
linux-cloud-tools-common
Purl
pkg:deb/tuxcare/linux-cloud-tools-common?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-doc

Package

Name
linux-doc
Purl
pkg:deb/tuxcare/linux-doc?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-headers-4.4.0-291

Package

Name
linux-headers-4.4.0-291
Purl
pkg:deb/tuxcare/linux-headers-4.4.0-291?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-headers-4.4.0-291-generic

Package

Name
linux-headers-4.4.0-291-generic
Purl
pkg:deb/tuxcare/linux-headers-4.4.0-291-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-headers-4.4.0-291-lowlatency

Package

Name
linux-headers-4.4.0-291-lowlatency
Purl
pkg:deb/tuxcare/linux-headers-4.4.0-291-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-image-unsigned-4.4.0-291-generic

Package

Name
linux-image-unsigned-4.4.0-291-generic
Purl
pkg:deb/tuxcare/linux-image-unsigned-4.4.0-291-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-image-unsigned-4.4.0-291-lowlatency

Package

Name
linux-image-unsigned-4.4.0-291-lowlatency
Purl
pkg:deb/tuxcare/linux-image-unsigned-4.4.0-291-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-libc-dev

Package

Name
linux-libc-dev
Purl
pkg:deb/tuxcare/linux-libc-dev?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-modules-4.4.0-291-generic

Package

Name
linux-modules-4.4.0-291-generic
Purl
pkg:deb/tuxcare/linux-modules-4.4.0-291-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-modules-4.4.0-291-lowlatency

Package

Name
linux-modules-4.4.0-291-lowlatency
Purl
pkg:deb/tuxcare/linux-modules-4.4.0-291-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-modules-extra-4.4.0-291-generic

Package

Name
linux-modules-extra-4.4.0-291-generic
Purl
pkg:deb/tuxcare/linux-modules-extra-4.4.0-291-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-source-4.4.0

Package

Name
linux-source-4.4.0
Purl
pkg:deb/tuxcare/linux-source-4.4.0?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-tools-4.4.0-291

Package

Name
linux-tools-4.4.0-291
Purl
pkg:deb/tuxcare/linux-tools-4.4.0-291?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-tools-4.4.0-291-generic

Package

Name
linux-tools-4.4.0-291-generic
Purl
pkg:deb/tuxcare/linux-tools-4.4.0-291-generic?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-tools-4.4.0-291-lowlatency

Package

Name
linux-tools-4.4.0-291-lowlatency
Purl
pkg:deb/tuxcare/linux-tools-4.4.0-291-lowlatency?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-tools-common

Package

Name
linux-tools-common
Purl
pkg:deb/tuxcare/linux-tools-common?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"
linux-tools-host

Package

Name
linux-tools-host
Purl
pkg:deb/tuxcare/linux-tools-host?distro=ubuntu-16.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-291.325+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792980237.json"