{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-headers-6.8.0-138", "linux-headers-6.8.0-138-generic", "linux-image-6.8.0-138-generic", "linux-modules-6.8.0-138-generic", "linux-tools-6.8.0-138", "linux-tools-6.8.0-138-generic" ], "removed": [ "linux-headers-6.8.0-137", "linux-headers-6.8.0-137-generic", "linux-image-6.8.0-137-generic", "linux-modules-6.8.0-137-generic", "linux-tools-6.8.0-137", "linux-tools-6.8.0-137-generic" ], "diff": [ "bind9-dnsutils", "bind9-host", "bind9-libs", "byobu", "console-setup", "console-setup-linux", "curl", "keyboard-configuration", "libcurl3t64-gnutls", "libcurl4t64", "libheif-plugin-aomdec", "libheif-plugin-aomenc", "libheif1", "libproc2-0", "libpython3.12-minimal", "libpython3.12-stdlib", "libpython3.12t64", "libssl3t64", "linux-headers-generic", "linux-headers-virtual", "linux-image-virtual", "linux-libc-dev", "linux-tools-common", "linux-virtual", "open-vm-tools", "openssl", "procps", "python3.12", "python3.12-minimal", "snapd", "vim", "vim-common", "vim-runtime", "vim-tiny", "wget", "xxd" ] } }, "diff": { "deb": [ { "name": "bind9-dnsutils", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.5", "version": "1:9.18.39-0ubuntu0.24.04.5" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.6", "version": "1:9.18.39-0ubuntu0.24.04.6" }, "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incorrect acceptance of NSEC3 records", " - debian/patches/CVE-2026-10723-1.patch: Check NSEC3 signer matches the", " owning zone in lib/dns/dnssec.c, lib/isc/result.c.", " - debian/patches/CVE-2026-10723-2.patch: Reproducer for #5874 NSEC3", " impersonation in bin/tests/system/repro_5874_nsec3_parent/ans1/ans.py,", " bin/tests/system/repro_5874_nsec3_parent/ns2/named.conf.j2,", " bin/tests/system/repro_5874_nsec3_parent/server.py,", " bin/tests/system/repro_5874_nsec3_parent/tests_repro_5874_nsec3_parent.py.", " - debian/patches/CVE-2026-10723-3.patch: Update reproducer #5874 in", " bin/tests/system/nsec3_impersonation/ans1/ans.py,", " bin/tests/system/nsec3_impersonation/ns2/named.conf.j2,", " bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py.", " - CVE-2026-10723", " * SECURITY UPDATE: Key Record using PRIVATEDNS algorithm may lead to", " unexpected exit", " - debian/patches/CVE-2026-10822-1.patch: Check that dns_name_fromwire", " honours the active region in tests/dns/name_test.c.", " - debian/patches/CVE-2026-10822-2.patch: Fix the yaml query zone name code", " in dnstap-read in bin/tools/dnstap-read.c.", " - debian/patches/CVE-2026-10822-3.patch: Fix dns_name_fromwire to honour the", " active region in lib/dns/name.c.", " - debian/patches/CVE-2026-10822-5.patch: Check that a short PRIVATEDNS", " record is rejected in tests/dns/rdata_test.c.", " - CVE-2026-10822", " * SECURITY UPDATE: Potential wildcard CNAME RPZ policy bypass", " - debian/patches/CVE-2026-11331-1.patch: Fix TTL extraction from A/AAAA", " record in bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-2.patch: Check rpz name too long wildcard", " CNAME expansion handling in bin/tests/system/rpz/ns2/tld2.db,", " bin/tests/system/rpz/ns4/tld4.db, bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-3.patch: Properly handle rpz name to long", " wildcard expansion in lib/ns/query.c.", " - CVE-2026-11331", " * SECURITY UPDATE: Potential memory usage beyond configured limits", " - debian/patches/CVE-2026-11622.patch: Make the dns_slabheaders in the cache", " reference counted in bin/tests/system/reclimit/tests.sh, lib/dns/rbtdb.c.", " - CVE-2026-11622", " * SECURITY UPDATE: Cache poisoning possible with label count discrepancy,", " RRSIG, and wildcards", " - debian/patches/CVE-2026-11721-1.patch: Don't sign out of zone records in", " dnssec-signzone in bin/dnssec/dnssec-signzone.c.", " - debian/patches/CVE-2026-11721-2.patch: Invalid signed wildcard records", " were being accepted in lib/dns/dnssec.c, lib/dns/rdata/generic/rrsig_46.c.", " - debian/patches/CVE-2026-11721-3.patch: Test RRSIG record parsing in", " tests/dns/rdata_test.c.", " - CVE-2026-11721", " * SECURITY UPDATE:Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-12617-1.patch: Do not assert in some CNAME/DNAME", " queries in lib/dns/resolver.c.", " - debian/patches/CVE-2026-12617-2.patch: Reproducer for #5946 (assertion in", " some CNAME/DNAME queries) in", " bin/tests/system/cname_dname_negcache/ans2/ans.py,", " bin/tests/system/cname_dname_negcache/ns1/bar.test.db,", " bin/tests/system/cname_dname_negcache/ns1/named.conf.j2,", " bin/tests/system/cname_dname_negcache/ns1/root.db,", " bin/tests/system/cname_dname_negcache/ns1/test.db,", " bin/tests/system/cname_dname_negcache/ns3/named.conf.j2,", " bin/tests/system/cname_dname_negcache/tests_cname_dname_negcache.py.", " - CVE-2026-12617", " * SECURITY UPDATE: Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-13321-1.patch: Add system test for out-of-zone", " nsec dnssec bypass in bin/tests/system/dnssec_bypass/ns1/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns1/root.db,", " bin/tests/system/dnssec_bypass/ns1/test.db,", " bin/tests/system/dnssec_bypass/ns2/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns2/victim.db,", " bin/tests/system/dnssec_bypass/ns3/evil.db,", " bin/tests/system/dnssec_bypass/ns3/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns4/named.conf.j2,", " bin/tests/system/dnssec_bypass/tests_bypass.py.", " - debian/patches/CVE-2026-13321-2.patch: Reject out-of-zone NSEC next owner", " names in lib/dns/dnssec.c, lib/dns/include/dns/dnssec.h.", " - debian/patches/CVE-2026-13321-3.patch: change", " dns_nsec_requiredtypespresent to dns_nsec_is_legal in", " lib/dns/include/dns/nsec.h, lib/dns/nsec.c, lib/dns/resolver.c,", " lib/ns/query.c.", " - CVE-2026-13321", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.24.04.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 24 Jul 2026 11:06:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-host", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.5", "version": "1:9.18.39-0ubuntu0.24.04.5" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.6", "version": "1:9.18.39-0ubuntu0.24.04.6" }, "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incorrect acceptance of NSEC3 records", " - debian/patches/CVE-2026-10723-1.patch: Check NSEC3 signer matches the", " owning zone in lib/dns/dnssec.c, lib/isc/result.c.", " - debian/patches/CVE-2026-10723-2.patch: Reproducer for #5874 NSEC3", " impersonation in bin/tests/system/repro_5874_nsec3_parent/ans1/ans.py,", " bin/tests/system/repro_5874_nsec3_parent/ns2/named.conf.j2,", " bin/tests/system/repro_5874_nsec3_parent/server.py,", " bin/tests/system/repro_5874_nsec3_parent/tests_repro_5874_nsec3_parent.py.", " - debian/patches/CVE-2026-10723-3.patch: Update reproducer #5874 in", " bin/tests/system/nsec3_impersonation/ans1/ans.py,", " bin/tests/system/nsec3_impersonation/ns2/named.conf.j2,", " bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py.", " - CVE-2026-10723", " * SECURITY UPDATE: Key Record using PRIVATEDNS algorithm may lead to", " unexpected exit", " - debian/patches/CVE-2026-10822-1.patch: Check that dns_name_fromwire", " honours the active region in tests/dns/name_test.c.", " - debian/patches/CVE-2026-10822-2.patch: Fix the yaml query zone name code", " in dnstap-read in bin/tools/dnstap-read.c.", " - debian/patches/CVE-2026-10822-3.patch: Fix dns_name_fromwire to honour the", " active region in lib/dns/name.c.", " - debian/patches/CVE-2026-10822-5.patch: Check that a short PRIVATEDNS", " record is rejected in tests/dns/rdata_test.c.", " - CVE-2026-10822", " * SECURITY UPDATE: Potential wildcard CNAME RPZ policy bypass", " - debian/patches/CVE-2026-11331-1.patch: Fix TTL extraction from A/AAAA", " record in bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-2.patch: Check rpz name too long wildcard", " CNAME expansion handling in bin/tests/system/rpz/ns2/tld2.db,", " bin/tests/system/rpz/ns4/tld4.db, bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-3.patch: Properly handle rpz name to long", " wildcard expansion in lib/ns/query.c.", " - CVE-2026-11331", " * SECURITY UPDATE: Potential memory usage beyond configured limits", " - debian/patches/CVE-2026-11622.patch: Make the dns_slabheaders in the cache", " reference counted in bin/tests/system/reclimit/tests.sh, lib/dns/rbtdb.c.", " - CVE-2026-11622", " * SECURITY UPDATE: Cache poisoning possible with label count discrepancy,", " RRSIG, and wildcards", " - debian/patches/CVE-2026-11721-1.patch: Don't sign out of zone records in", " dnssec-signzone in bin/dnssec/dnssec-signzone.c.", " - debian/patches/CVE-2026-11721-2.patch: Invalid signed wildcard records", " were being accepted in lib/dns/dnssec.c, lib/dns/rdata/generic/rrsig_46.c.", " - debian/patches/CVE-2026-11721-3.patch: Test RRSIG record parsing in", " tests/dns/rdata_test.c.", " - CVE-2026-11721", " * SECURITY UPDATE:Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-12617-1.patch: Do not assert in some CNAME/DNAME", " queries in lib/dns/resolver.c.", " - debian/patches/CVE-2026-12617-2.patch: Reproducer for #5946 (assertion in", " some CNAME/DNAME queries) in", " bin/tests/system/cname_dname_negcache/ans2/ans.py,", " bin/tests/system/cname_dname_negcache/ns1/bar.test.db,", " bin/tests/system/cname_dname_negcache/ns1/named.conf.j2,", " bin/tests/system/cname_dname_negcache/ns1/root.db,", " bin/tests/system/cname_dname_negcache/ns1/test.db,", " bin/tests/system/cname_dname_negcache/ns3/named.conf.j2,", " bin/tests/system/cname_dname_negcache/tests_cname_dname_negcache.py.", " - CVE-2026-12617", " * SECURITY UPDATE: Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-13321-1.patch: Add system test for out-of-zone", " nsec dnssec bypass in bin/tests/system/dnssec_bypass/ns1/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns1/root.db,", " bin/tests/system/dnssec_bypass/ns1/test.db,", " bin/tests/system/dnssec_bypass/ns2/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns2/victim.db,", " bin/tests/system/dnssec_bypass/ns3/evil.db,", " bin/tests/system/dnssec_bypass/ns3/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns4/named.conf.j2,", " bin/tests/system/dnssec_bypass/tests_bypass.py.", " - debian/patches/CVE-2026-13321-2.patch: Reject out-of-zone NSEC next owner", " names in lib/dns/dnssec.c, lib/dns/include/dns/dnssec.h.", " - debian/patches/CVE-2026-13321-3.patch: change", " dns_nsec_requiredtypespresent to dns_nsec_is_legal in", " lib/dns/include/dns/nsec.h, lib/dns/nsec.c, lib/dns/resolver.c,", " lib/ns/query.c.", " - CVE-2026-13321", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.24.04.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 24 Jul 2026 11:06:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-libs", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.5", "version": "1:9.18.39-0ubuntu0.24.04.5" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.24.04.6", "version": "1:9.18.39-0ubuntu0.24.04.6" }, "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incorrect acceptance of NSEC3 records", " - debian/patches/CVE-2026-10723-1.patch: Check NSEC3 signer matches the", " owning zone in lib/dns/dnssec.c, lib/isc/result.c.", " - debian/patches/CVE-2026-10723-2.patch: Reproducer for #5874 NSEC3", " impersonation in bin/tests/system/repro_5874_nsec3_parent/ans1/ans.py,", " bin/tests/system/repro_5874_nsec3_parent/ns2/named.conf.j2,", " bin/tests/system/repro_5874_nsec3_parent/server.py,", " bin/tests/system/repro_5874_nsec3_parent/tests_repro_5874_nsec3_parent.py.", " - debian/patches/CVE-2026-10723-3.patch: Update reproducer #5874 in", " bin/tests/system/nsec3_impersonation/ans1/ans.py,", " bin/tests/system/nsec3_impersonation/ns2/named.conf.j2,", " bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py.", " - CVE-2026-10723", " * SECURITY UPDATE: Key Record using PRIVATEDNS algorithm may lead to", " unexpected exit", " - debian/patches/CVE-2026-10822-1.patch: Check that dns_name_fromwire", " honours the active region in tests/dns/name_test.c.", " - debian/patches/CVE-2026-10822-2.patch: Fix the yaml query zone name code", " in dnstap-read in bin/tools/dnstap-read.c.", " - debian/patches/CVE-2026-10822-3.patch: Fix dns_name_fromwire to honour the", " active region in lib/dns/name.c.", " - debian/patches/CVE-2026-10822-5.patch: Check that a short PRIVATEDNS", " record is rejected in tests/dns/rdata_test.c.", " - CVE-2026-10822", " * SECURITY UPDATE: Potential wildcard CNAME RPZ policy bypass", " - debian/patches/CVE-2026-11331-1.patch: Fix TTL extraction from A/AAAA", " record in bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-2.patch: Check rpz name too long wildcard", " CNAME expansion handling in bin/tests/system/rpz/ns2/tld2.db,", " bin/tests/system/rpz/ns4/tld4.db, bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-3.patch: Properly handle rpz name to long", " wildcard expansion in lib/ns/query.c.", " - CVE-2026-11331", " * SECURITY UPDATE: Potential memory usage beyond configured limits", " - debian/patches/CVE-2026-11622.patch: Make the dns_slabheaders in the cache", " reference counted in bin/tests/system/reclimit/tests.sh, lib/dns/rbtdb.c.", " - CVE-2026-11622", " * SECURITY UPDATE: Cache poisoning possible with label count discrepancy,", " RRSIG, and wildcards", " - debian/patches/CVE-2026-11721-1.patch: Don't sign out of zone records in", " dnssec-signzone in bin/dnssec/dnssec-signzone.c.", " - debian/patches/CVE-2026-11721-2.patch: Invalid signed wildcard records", " were being accepted in lib/dns/dnssec.c, lib/dns/rdata/generic/rrsig_46.c.", " - debian/patches/CVE-2026-11721-3.patch: Test RRSIG record parsing in", " tests/dns/rdata_test.c.", " - CVE-2026-11721", " * SECURITY UPDATE:Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-12617-1.patch: Do not assert in some CNAME/DNAME", " queries in lib/dns/resolver.c.", " - debian/patches/CVE-2026-12617-2.patch: Reproducer for #5946 (assertion in", " some CNAME/DNAME queries) in", " bin/tests/system/cname_dname_negcache/ans2/ans.py,", " bin/tests/system/cname_dname_negcache/ns1/bar.test.db,", " bin/tests/system/cname_dname_negcache/ns1/named.conf.j2,", " bin/tests/system/cname_dname_negcache/ns1/root.db,", " bin/tests/system/cname_dname_negcache/ns1/test.db,", " bin/tests/system/cname_dname_negcache/ns3/named.conf.j2,", " bin/tests/system/cname_dname_negcache/tests_cname_dname_negcache.py.", " - CVE-2026-12617", " * SECURITY UPDATE: Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-13321-1.patch: Add system test for out-of-zone", " nsec dnssec bypass in bin/tests/system/dnssec_bypass/ns1/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns1/root.db,", " bin/tests/system/dnssec_bypass/ns1/test.db,", " bin/tests/system/dnssec_bypass/ns2/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns2/victim.db,", " bin/tests/system/dnssec_bypass/ns3/evil.db,", " bin/tests/system/dnssec_bypass/ns3/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns4/named.conf.j2,", " bin/tests/system/dnssec_bypass/tests_bypass.py.", " - debian/patches/CVE-2026-13321-2.patch: Reject out-of-zone NSEC next owner", " names in lib/dns/dnssec.c, lib/dns/include/dns/dnssec.h.", " - debian/patches/CVE-2026-13321-3.patch: change", " dns_nsec_requiredtypespresent to dns_nsec_is_legal in", " lib/dns/include/dns/nsec.h, lib/dns/nsec.c, lib/dns/resolver.c,", " lib/ns/query.c.", " - CVE-2026-13321", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.24.04.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 24 Jul 2026 11:06:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "byobu", "from_version": { "source_package_name": "byobu", "source_package_version": "6.11-0ubuntu1", "version": "6.11-0ubuntu1" }, "to_version": { "source_package_name": "byobu", "source_package_version": "6.11-0ubuntu1.1", "version": "6.11-0ubuntu1.1" }, "cves": [], "launchpad_bugs_fixed": [ 2067490 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2067490-prompt-runtime-stdout.patch: don't output", " byobu_prompt_runtime to stderr (LP: #2067490)", "" ], "package": "byobu", "version": "6.11-0ubuntu1.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2067490 ], "author": "Andreas Hasenack ", "date": "Mon, 22 Jun 2026 15:59:45 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "console-setup", "from_version": { "source_package_name": "console-setup", "source_package_version": "1.226ubuntu1", "version": "1.226ubuntu1" }, "to_version": { "source_package_name": "console-setup", "source_package_version": "1.226ubuntu1.1", "version": "1.226ubuntu1.1" }, "cves": [], "launchpad_bugs_fixed": [ 2152901 ], "changes": [ { "cves": [], "log": [ "", " * No change rebuild against keymapper 0.6.3ubuntu0~24.04 (LP: #2152901).", " This should produce the expected pc105.tree file that core24-based", " Subiquity consumes at build time.", "" ], "package": "console-setup", "version": "1.226ubuntu1.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2152901 ], "author": "Olivier Gayot ", "date": "Fri, 05 Jun 2026 16:57:16 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "console-setup-linux", "from_version": { "source_package_name": "console-setup", "source_package_version": "1.226ubuntu1", "version": "1.226ubuntu1" }, "to_version": { "source_package_name": "console-setup", "source_package_version": "1.226ubuntu1.1", "version": "1.226ubuntu1.1" }, "cves": [], "launchpad_bugs_fixed": [ 2152901 ], "changes": [ { "cves": [], "log": [ "", " * No change rebuild against keymapper 0.6.3ubuntu0~24.04 (LP: #2152901).", " This should produce the expected pc105.tree file that core24-based", " Subiquity consumes at build time.", "" ], "package": "console-setup", "version": "1.226ubuntu1.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2152901 ], "author": "Olivier Gayot ", "date": "Fri, 05 Jun 2026 16:57:16 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "8.5.0-2ubuntu10.11", "version": "8.5.0-2ubuntu10.11" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.5.0-2ubuntu10.13", "version": "8.5.0-2ubuntu10.13" }, "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass in connection reuse.", " - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in", " lib/ldap.c, ../urldata.h, ../vquic/curl_ngtcp2.c,", " lib/vssh/libssh.c, ../libssh2.c,", " lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../schannel.c,", " ../sectransp.c, ../vtls.c, and ../wolfssl.c.", " - CVE-2026-8932", "" ], "package": "curl", "version": "8.5.0-2ubuntu10.13", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Thu, 20 Aug 2026 13:24:23 -0600" }, { "cves": [ { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", "" ], "package": "curl", "version": "8.5.0-2ubuntu10.12", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 13:28:10 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "keyboard-configuration", "from_version": { "source_package_name": "console-setup", "source_package_version": "1.226ubuntu1", "version": "1.226ubuntu1" }, "to_version": { "source_package_name": "console-setup", "source_package_version": "1.226ubuntu1.1", "version": "1.226ubuntu1.1" }, "cves": [], "launchpad_bugs_fixed": [ 2152901 ], "changes": [ { "cves": [], "log": [ "", " * No change rebuild against keymapper 0.6.3ubuntu0~24.04 (LP: #2152901).", " This should produce the expected pc105.tree file that core24-based", " Subiquity consumes at build time.", "" ], "package": "console-setup", "version": "1.226ubuntu1.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2152901 ], "author": "Olivier Gayot ", "date": "Fri, 05 Jun 2026 16:57:16 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl3t64-gnutls", "from_version": { "source_package_name": "curl", "source_package_version": "8.5.0-2ubuntu10.11", "version": "8.5.0-2ubuntu10.11" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.5.0-2ubuntu10.13", "version": "8.5.0-2ubuntu10.13" }, "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass in connection reuse.", " - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in", " lib/ldap.c, ../urldata.h, ../vquic/curl_ngtcp2.c,", " lib/vssh/libssh.c, ../libssh2.c,", " lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../schannel.c,", " ../sectransp.c, ../vtls.c, and ../wolfssl.c.", " - CVE-2026-8932", "" ], "package": "curl", "version": "8.5.0-2ubuntu10.13", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Thu, 20 Aug 2026 13:24:23 -0600" }, { "cves": [ { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", "" ], "package": "curl", "version": "8.5.0-2ubuntu10.12", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 13:28:10 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4t64", "from_version": { "source_package_name": "curl", "source_package_version": "8.5.0-2ubuntu10.11", "version": "8.5.0-2ubuntu10.11" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.5.0-2ubuntu10.13", "version": "8.5.0-2ubuntu10.13" }, "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass in connection reuse.", " - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in", " lib/ldap.c, ../urldata.h, ../vquic/curl_ngtcp2.c,", " lib/vssh/libssh.c, ../libssh2.c,", " lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../schannel.c,", " ../sectransp.c, ../vtls.c, and ../wolfssl.c.", " - CVE-2026-8932", "" ], "package": "curl", "version": "8.5.0-2ubuntu10.13", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Thu, 20 Aug 2026 13:24:23 -0600" }, { "cves": [ { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", "" ], "package": "curl", "version": "8.5.0-2ubuntu10.12", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 13:28:10 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libheif-plugin-aomdec", "from_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.6", "version": "1.17.6-1ubuntu4.6" }, "to_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.7", "version": "1.17.6-1ubuntu4.7" }, "cves": [ { "cve": "CVE-2026-62289", "url": "https://ubuntu.com/security/CVE-2026-62289", "cve_description": "Integer underflow in Fraction constructor via double clap transform application", "cve_priority": "medium", "cve_public_date": "2026-08-13" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-62289", "url": "https://ubuntu.com/security/CVE-2026-62289", "cve_description": "Integer underflow in Fraction constructor via double clap transform application", "cve_priority": "medium", "cve_public_date": "2026-08-13" } ], "log": [ "", " * SECURITY UPDATE: Integer underflow in Fraction constructor via double clap", " transform application", " - debian/patches/CVE-2026-62289.patch: Fix clap transform double-application", " in image tiling in libheif/box.cc, libheif/context.cc,", " tests/CMakeLists.txt, tests/clap_zero_size.cc.", " - CVE-2026-62289", "" ], "package": "libheif", "version": "1.17.6-1ubuntu4.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 17 Aug 2026 14:21:20 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libheif-plugin-aomenc", "from_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.6", "version": "1.17.6-1ubuntu4.6" }, "to_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.7", "version": "1.17.6-1ubuntu4.7" }, "cves": [ { "cve": "CVE-2026-62289", "url": "https://ubuntu.com/security/CVE-2026-62289", "cve_description": "Integer underflow in Fraction constructor via double clap transform application", "cve_priority": "medium", "cve_public_date": "2026-08-13" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-62289", "url": "https://ubuntu.com/security/CVE-2026-62289", "cve_description": "Integer underflow in Fraction constructor via double clap transform application", "cve_priority": "medium", "cve_public_date": "2026-08-13" } ], "log": [ "", " * SECURITY UPDATE: Integer underflow in Fraction constructor via double clap", " transform application", " - debian/patches/CVE-2026-62289.patch: Fix clap transform double-application", " in image tiling in libheif/box.cc, libheif/context.cc,", " tests/CMakeLists.txt, tests/clap_zero_size.cc.", " - CVE-2026-62289", "" ], "package": "libheif", "version": "1.17.6-1ubuntu4.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 17 Aug 2026 14:21:20 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libheif1", "from_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.6", "version": "1.17.6-1ubuntu4.6" }, "to_version": { "source_package_name": "libheif", "source_package_version": "1.17.6-1ubuntu4.7", "version": "1.17.6-1ubuntu4.7" }, "cves": [ { "cve": "CVE-2026-62289", "url": "https://ubuntu.com/security/CVE-2026-62289", "cve_description": "Integer underflow in Fraction constructor via double clap transform application", "cve_priority": "medium", "cve_public_date": "2026-08-13" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-62289", "url": "https://ubuntu.com/security/CVE-2026-62289", "cve_description": "Integer underflow in Fraction constructor via double clap transform application", "cve_priority": "medium", "cve_public_date": "2026-08-13" } ], "log": [ "", " * SECURITY UPDATE: Integer underflow in Fraction constructor via double clap", " transform application", " - debian/patches/CVE-2026-62289.patch: Fix clap transform double-application", " in image tiling in libheif/box.cc, libheif/context.cc,", " tests/CMakeLists.txt, tests/clap_zero_size.cc.", " - CVE-2026-62289", "" ], "package": "libheif", "version": "1.17.6-1ubuntu4.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 17 Aug 2026 14:21:20 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libproc2-0", "from_version": { "source_package_name": "procps", "source_package_version": "2:4.0.4-4ubuntu3.2", "version": "2:4.0.4-4ubuntu3.2" }, "to_version": { "source_package_name": "procps", "source_package_version": "2:4.0.4-4ubuntu3.3", "version": "2:4.0.4-4ubuntu3.3" }, "cves": [], "launchpad_bugs_fixed": [ 2159938 ], "changes": [ { "cves": [], "log": [ "", " * Use clock_gettime instead of procps_uptime for boot time (LP: #2159938)", " - d/p/lp2159938-library_use_clock_gettime.patch", "" ], "package": "procps", "version": "2:4.0.4-4ubuntu3.3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2159938 ], "author": "Bhavya Dokuru ", "date": "Mon, 13 Jul 2026 20:13:08 +0530" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.12-minimal", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.15", "version": "3.12.3-1ubuntu0.15" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "cves": [], "launchpad_bugs_fixed": [ 2157534 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2157534-ssl-memory-leak.patch: Fixes a memory leak", " in ssl.SSLSocket.session. (LP: #2157534)", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.16", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2157534 ], "author": "Finn Rayk Gartner ", "date": "Thu, 16 Jul 2026 01:46:41 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.12-stdlib", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.15", "version": "3.12.3-1ubuntu0.15" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "cves": [], "launchpad_bugs_fixed": [ 2157534 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2157534-ssl-memory-leak.patch: Fixes a memory leak", " in ssl.SSLSocket.session. (LP: #2157534)", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.16", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2157534 ], "author": "Finn Rayk Gartner ", "date": "Thu, 16 Jul 2026 01:46:41 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.12t64", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.15", "version": "3.12.3-1ubuntu0.15" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "cves": [], "launchpad_bugs_fixed": [ 2157534 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2157534-ssl-memory-leak.patch: Fixes a memory leak", " in ssl.SSLSocket.session. (LP: #2157534)", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.16", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2157534 ], "author": "Finn Rayk Gartner ", "date": "Thu, 16 Jul 2026 01:46:41 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssl3t64", "from_version": { "source_package_name": "openssl", "source_package_version": "3.0.13-0ubuntu3.12", "version": "3.0.13-0ubuntu3.12" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.0.13-0ubuntu3.15", "version": "3.0.13-0ubuntu3.15" }, "cves": [ { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "CMP Indefinite Cache Growth of ExtraCerts", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()", "cve_priority": "low", "cve_public_date": "2026-08-25" } ], "launchpad_bugs_fixed": [ 2130576, 2107167, 2137464 ], "changes": [ { "cves": [ { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "CMP Indefinite Cache Growth of ExtraCerts", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()", "cve_priority": "low", "cve_public_date": "2026-08-25" } ], "log": [ "", " * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future", " Epoch", " - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation", " when buffering DTLS records in ssl/record/rec_layer_d1.c,", " ssl/record/record.h, ssl/record/ssl3_record.c.", " - debian/patches/CVE-2026-54874-2.patch: ssl/record: lower the DTLS", " unprocessed_rcds queue limit in ssl/record/rec_layer_d1.c,", " ssl/record/record_local.h, ssl/record/ssl3_record.c.", " - CVE-2026-54874", " * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping", " - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in", " test/cmsapitest.c, test/recipes/80-test_cmsapi.t.", " - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte", " OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.", " - CVE-2026-63072", " * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts", " - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth", " in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,", " test/recipes/65-test_cmp_msg.t.", " - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in", " cmp in crypto/cmp/cmp_vfy.c.", " - CVE-2026-63074", " * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted", " protectionAlg", " - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in", " test/cmp_protect_test.c.", " - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in", " ossl_cmp_calc_protection() via crafted protectionAlg in", " crypto/cmp/cmp_protect.c.", " - CVE-2026-63076", " * SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using", " EVP_Cipher()", " - debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()", " finalize: Poly1305 and OCB AEADs in", " providers/implementations/ciphers/cipher_aes_ocb.c,", " providers/implementations/ciphers/cipher_chacha20_poly1305.c.", " - debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD", " EVP_Cipher() finalization in test/evp_extra_test.c.", " - CVE-2026-75803", "" ], "package": "openssl", "version": "3.0.13-0ubuntu3.15", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 18 Aug 2026 08:10:36 -0400" }, { "cves": [], "log": [ "", " * Enable ec_nistp_64_gcc_128 optimization on multiple 64-bit", " architectures (LP: #2130576).", " Thanks to Szilárd Pfeiffer for the ", " bug report and patch.", " * Fix /usr/share/doc/openssl/ symlinks (LP: #2107167)", " * Fix crypto/ec/asm/ecp_nistp521-ppc64.pl output regex failure", " (LP: #2137464)", " - d/p/regex_match_ecp_nistp521-ppc64.patch", "" ], "package": "openssl", "version": "3.0.13-0ubuntu3.13", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2130576, 2107167, 2137464 ], "author": "Ravi Kant Sharma ", "date": "Wed, 05 Aug 2026 12:04:50 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-generic", "from_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 6.8.0-138.138", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 6.8.0-138.138", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 6.8.0-138.138", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-libc-dev", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162236 ], "changes": [ { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-138.138 -proposed tracker (LP: #2162236)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162236 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:05 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-common", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162236 ], "changes": [ { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-138.138 -proposed tracker (LP: #2162236)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162236 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:05 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 6.8.0-138.138", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "open-vm-tools", "from_version": { "source_package_name": "open-vm-tools", "source_package_version": "2:13.0.0-2~ubuntu0.24.04.1", "version": "2:13.0.0-2~ubuntu0.24.04.1" }, "to_version": { "source_package_name": "open-vm-tools", "source_package_version": "2:13.0.10-0ubuntu0.24.04.1", "version": "2:13.0.10-0ubuntu0.24.04.1" }, "cves": [ { "cve": "CVE-2025-41244", "url": "https://ubuntu.com/security/CVE-2025-41244", "cve_description": "VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.", "cve_priority": "medium", "cve_public_date": "2025-09-29 17:15:00 UTC" } ], "launchpad_bugs_fixed": [ 2153486 ], "changes": [ { "cves": [ { "cve": "CVE-2025-41244", "url": "https://ubuntu.com/security/CVE-2025-41244", "cve_description": "VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.", "cve_priority": "medium", "cve_public_date": "2025-09-29 17:15:00 UTC" } ], "log": [ "", " * Backport recent open-vm-tools release v13.0.10 (LP: #2153486)", " - For changes included in this update, see:", " https://github.com/vmware/open-vm-tools/blob/stable-13.0.10/ReleaseNotes.md", " - d/p/CVE-2025-41244.patch: dropped, applied in upstream version 13.0.5", " - d/control: remove Build-dep on libgdk-pixbuf-xlib-2.0-dev (see Debian", " bug #1112399)", "" ], "package": "open-vm-tools", "version": "2:13.0.10-0ubuntu0.24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2153486 ], "author": "Renan Rodrigo ", "date": "Wed, 01 Jul 2026 11:41:41 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl", "from_version": { "source_package_name": "openssl", "source_package_version": "3.0.13-0ubuntu3.12", "version": "3.0.13-0ubuntu3.12" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.0.13-0ubuntu3.15", "version": "3.0.13-0ubuntu3.15" }, "cves": [ { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "CMP Indefinite Cache Growth of ExtraCerts", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()", "cve_priority": "low", "cve_public_date": "2026-08-25" } ], "launchpad_bugs_fixed": [ 2130576, 2107167, 2137464 ], "changes": [ { "cves": [ { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "CMP Indefinite Cache Growth of ExtraCerts", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()", "cve_priority": "low", "cve_public_date": "2026-08-25" } ], "log": [ "", " * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future", " Epoch", " - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation", " when buffering DTLS records in ssl/record/rec_layer_d1.c,", " ssl/record/record.h, ssl/record/ssl3_record.c.", " - debian/patches/CVE-2026-54874-2.patch: ssl/record: lower the DTLS", " unprocessed_rcds queue limit in ssl/record/rec_layer_d1.c,", " ssl/record/record_local.h, ssl/record/ssl3_record.c.", " - CVE-2026-54874", " * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping", " - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in", " test/cmsapitest.c, test/recipes/80-test_cmsapi.t.", " - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte", " OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.", " - CVE-2026-63072", " * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts", " - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth", " in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,", " test/recipes/65-test_cmp_msg.t.", " - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in", " cmp in crypto/cmp/cmp_vfy.c.", " - CVE-2026-63074", " * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted", " protectionAlg", " - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in", " test/cmp_protect_test.c.", " - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in", " ossl_cmp_calc_protection() via crafted protectionAlg in", " crypto/cmp/cmp_protect.c.", " - CVE-2026-63076", " * SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using", " EVP_Cipher()", " - debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()", " finalize: Poly1305 and OCB AEADs in", " providers/implementations/ciphers/cipher_aes_ocb.c,", " providers/implementations/ciphers/cipher_chacha20_poly1305.c.", " - debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD", " EVP_Cipher() finalization in test/evp_extra_test.c.", " - CVE-2026-75803", "" ], "package": "openssl", "version": "3.0.13-0ubuntu3.15", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 18 Aug 2026 08:10:36 -0400" }, { "cves": [], "log": [ "", " * Enable ec_nistp_64_gcc_128 optimization on multiple 64-bit", " architectures (LP: #2130576).", " Thanks to Szilárd Pfeiffer for the ", " bug report and patch.", " * Fix /usr/share/doc/openssl/ symlinks (LP: #2107167)", " * Fix crypto/ec/asm/ecp_nistp521-ppc64.pl output regex failure", " (LP: #2137464)", " - d/p/regex_match_ecp_nistp521-ppc64.patch", "" ], "package": "openssl", "version": "3.0.13-0ubuntu3.13", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2130576, 2107167, 2137464 ], "author": "Ravi Kant Sharma ", "date": "Wed, 05 Aug 2026 12:04:50 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "procps", "from_version": { "source_package_name": "procps", "source_package_version": "2:4.0.4-4ubuntu3.2", "version": "2:4.0.4-4ubuntu3.2" }, "to_version": { "source_package_name": "procps", "source_package_version": "2:4.0.4-4ubuntu3.3", "version": "2:4.0.4-4ubuntu3.3" }, "cves": [], "launchpad_bugs_fixed": [ 2159938 ], "changes": [ { "cves": [], "log": [ "", " * Use clock_gettime instead of procps_uptime for boot time (LP: #2159938)", " - d/p/lp2159938-library_use_clock_gettime.patch", "" ], "package": "procps", "version": "2:4.0.4-4ubuntu3.3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2159938 ], "author": "Bhavya Dokuru ", "date": "Mon, 13 Jul 2026 20:13:08 +0530" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.12", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.15", "version": "3.12.3-1ubuntu0.15" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "cves": [], "launchpad_bugs_fixed": [ 2157534 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2157534-ssl-memory-leak.patch: Fixes a memory leak", " in ssl.SSLSocket.session. (LP: #2157534)", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.16", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2157534 ], "author": "Finn Rayk Gartner ", "date": "Thu, 16 Jul 2026 01:46:41 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.12-minimal", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.15", "version": "3.12.3-1ubuntu0.15" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "cves": [], "launchpad_bugs_fixed": [ 2157534 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2157534-ssl-memory-leak.patch: Fixes a memory leak", " in ssl.SSLSocket.session. (LP: #2157534)", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.16", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2157534 ], "author": "Finn Rayk Gartner ", "date": "Thu, 16 Jul 2026 01:46:41 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "snapd", "from_version": { "source_package_name": "snapd", "source_package_version": "2.76+ubuntu24.04.1", "version": "2.76+ubuntu24.04.1" }, "to_version": { "source_package_name": "snapd", "source_package_version": "2.76.3+ubuntu24.04", "version": "2.76.3+ubuntu24.04" }, "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158301, 2159940, 2157692, 2067006 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release, LP: #2158301", " - FDE: support keyboard configuration at install-time for first-boot", " - FDE: re-enable passphrases/PINs at install-time", " - FDE: require volumes authentication if HWROT is missing", " - FDE: bump secboot to rev 457b03a16d19", " - FDE: use new secboot API for reprovision TPM", " - Cross-distro: modify SELinux policy to use", " init_named_socket_activation() for allowing systemd to start snapd", " through socket activation", " - packaging: make sure that usr/bin/snap is built with correct build", " tags on debian sid", " - Ensure profiles are setup before running prepare-{slot, plug}*", " hooks", "" ], "package": "snapd", "version": "2.76.3+ubuntu24.04", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2158301 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 10:06:48 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2159940", " - interfaces: steam-support, docker-support | fix mountinfo denial", "" ], "package": "snapd", "version": "2.76.2+ubuntu24.04", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2159940 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 08:38:51 +0200" }, { "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "log": [ "", " * New upstream release, LP: #2157692", " - LP: #2067006 CVE-2024-5300", " - CVE-2026-3888", "" ], "package": "snapd", "version": "2.76.1+ubuntu24.04", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2157692, 2067006 ], "author": "Ernest Lotter ", "date": "Thu, 25 Jun 2026 13:09:05 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.18", "version": "2:9.1.0016-1ubuntu7.18" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.20", "version": "2:9.1.0016-1ubuntu7.20" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" }, { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163785 ], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.20", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:13:04 -0600" }, { "cves": [ { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)", " - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in", " runtime/autoload/netrw.vim", " - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname", " in runtime/autoload/netrw.vim", " * SECURITY UPDATE: Use-after-free on json decode error.", " - debian/patches/CVE-2026-73071.patch: Report the position from the", " current reader in src/json.c.", " - CVE-2026-73071", " * SECURITY UPDATE: Heap buffer overflow in set_sofo().", " - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in", " src/spellfile.c.", " - CVE-2026-73072", " * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.", " - debian/patches/CVE-2026-73074.patch: Verify that the number of text", " properties falls within the limit in src/errors.h and src/textprop.c.", " - CVE-2026-73074", " * SECURITY UPDATE: Code execution via VimballRecord file.", " - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix", " broken directory deletion code, and refactor code in", " runtime/autoload/vimball.vim", " - CVE-2026-73076", " * SECURITY UPDATE: Arbitrary code execution via keyword lookup.", " - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands", " using single quotes, for sh/zsh pass the argument as a separate list", " item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,", " and ../zsh.vim.", " - CVE-2026-73077", " * SECURITY UPDATE: Code injection in netrw via bookmarks.", " - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in", " runtime/autoload/netrw.vim.", " - CVE-2026-73078", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2163785 ], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 14:09:09 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-common", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.18", "version": "2:9.1.0016-1ubuntu7.18" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.20", "version": "2:9.1.0016-1ubuntu7.20" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" }, { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163785 ], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.20", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:13:04 -0600" }, { "cves": [ { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)", " - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in", " runtime/autoload/netrw.vim", " - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname", " in runtime/autoload/netrw.vim", " * SECURITY UPDATE: Use-after-free on json decode error.", " - debian/patches/CVE-2026-73071.patch: Report the position from the", " current reader in src/json.c.", " - CVE-2026-73071", " * SECURITY UPDATE: Heap buffer overflow in set_sofo().", " - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in", " src/spellfile.c.", " - CVE-2026-73072", " * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.", " - debian/patches/CVE-2026-73074.patch: Verify that the number of text", " properties falls within the limit in src/errors.h and src/textprop.c.", " - CVE-2026-73074", " * SECURITY UPDATE: Code execution via VimballRecord file.", " - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix", " broken directory deletion code, and refactor code in", " runtime/autoload/vimball.vim", " - CVE-2026-73076", " * SECURITY UPDATE: Arbitrary code execution via keyword lookup.", " - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands", " using single quotes, for sh/zsh pass the argument as a separate list", " item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,", " and ../zsh.vim.", " - CVE-2026-73077", " * SECURITY UPDATE: Code injection in netrw via bookmarks.", " - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in", " runtime/autoload/netrw.vim.", " - CVE-2026-73078", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2163785 ], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 14:09:09 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-runtime", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.18", "version": "2:9.1.0016-1ubuntu7.18" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.20", "version": "2:9.1.0016-1ubuntu7.20" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" }, { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163785 ], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.20", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:13:04 -0600" }, { "cves": [ { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)", " - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in", " runtime/autoload/netrw.vim", " - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname", " in runtime/autoload/netrw.vim", " * SECURITY UPDATE: Use-after-free on json decode error.", " - debian/patches/CVE-2026-73071.patch: Report the position from the", " current reader in src/json.c.", " - CVE-2026-73071", " * SECURITY UPDATE: Heap buffer overflow in set_sofo().", " - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in", " src/spellfile.c.", " - CVE-2026-73072", " * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.", " - debian/patches/CVE-2026-73074.patch: Verify that the number of text", " properties falls within the limit in src/errors.h and src/textprop.c.", " - CVE-2026-73074", " * SECURITY UPDATE: Code execution via VimballRecord file.", " - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix", " broken directory deletion code, and refactor code in", " runtime/autoload/vimball.vim", " - CVE-2026-73076", " * SECURITY UPDATE: Arbitrary code execution via keyword lookup.", " - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands", " using single quotes, for sh/zsh pass the argument as a separate list", " item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,", " and ../zsh.vim.", " - CVE-2026-73077", " * SECURITY UPDATE: Code injection in netrw via bookmarks.", " - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in", " runtime/autoload/netrw.vim.", " - CVE-2026-73078", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2163785 ], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 14:09:09 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-tiny", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.18", "version": "2:9.1.0016-1ubuntu7.18" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.20", "version": "2:9.1.0016-1ubuntu7.20" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" }, { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163785 ], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.20", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:13:04 -0600" }, { "cves": [ { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)", " - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in", " runtime/autoload/netrw.vim", " - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname", " in runtime/autoload/netrw.vim", " * SECURITY UPDATE: Use-after-free on json decode error.", " - debian/patches/CVE-2026-73071.patch: Report the position from the", " current reader in src/json.c.", " - CVE-2026-73071", " * SECURITY UPDATE: Heap buffer overflow in set_sofo().", " - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in", " src/spellfile.c.", " - CVE-2026-73072", " * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.", " - debian/patches/CVE-2026-73074.patch: Verify that the number of text", " properties falls within the limit in src/errors.h and src/textprop.c.", " - CVE-2026-73074", " * SECURITY UPDATE: Code execution via VimballRecord file.", " - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix", " broken directory deletion code, and refactor code in", " runtime/autoload/vimball.vim", " - CVE-2026-73076", " * SECURITY UPDATE: Arbitrary code execution via keyword lookup.", " - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands", " using single quotes, for sh/zsh pass the argument as a separate list", " item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,", " and ../zsh.vim.", " - CVE-2026-73077", " * SECURITY UPDATE: Code injection in netrw via bookmarks.", " - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in", " runtime/autoload/netrw.vim.", " - CVE-2026-73078", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2163785 ], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 14:09:09 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "wget", "from_version": { "source_package_name": "wget", "source_package_version": "1.21.4-1ubuntu4.4", "version": "1.21.4-1ubuntu4.4" }, "to_version": { "source_package_name": "wget", "source_package_version": "1.21.4-1ubuntu4.5", "version": "1.21.4-1ubuntu4.5" }, "cves": [ { "cve": "CVE-2026-58472", "url": "https://ubuntu.com/security/CVE-2026-58472", "cve_description": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163754 ], "changes": [ { "cves": [ { "cve": "CVE-2026-58472", "url": "https://ubuntu.com/security/CVE-2026-58472", "cve_description": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-58472 (LP: #2163754)", " - debian/patches/CVE-2026-58472-post1.patch: Fix buffer overflow in", " src/convert.c", "" ], "package": "wget", "version": "1.21.4-1ubuntu4.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2163754 ], "author": "Kyle Kernick ", "date": "Wed, 19 Aug 2026 18:00:36 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "xxd", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.18", "version": "2:9.1.0016-1ubuntu7.18" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:9.1.0016-1ubuntu7.20", "version": "2:9.1.0016-1ubuntu7.20" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" }, { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163785 ], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.20", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:13:04 -0600" }, { "cves": [ { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)", " - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in", " runtime/autoload/netrw.vim", " - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname", " in runtime/autoload/netrw.vim", " * SECURITY UPDATE: Use-after-free on json decode error.", " - debian/patches/CVE-2026-73071.patch: Report the position from the", " current reader in src/json.c.", " - CVE-2026-73071", " * SECURITY UPDATE: Heap buffer overflow in set_sofo().", " - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in", " src/spellfile.c.", " - CVE-2026-73072", " * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.", " - debian/patches/CVE-2026-73074.patch: Verify that the number of text", " properties falls within the limit in src/errors.h and src/textprop.c.", " - CVE-2026-73074", " * SECURITY UPDATE: Code execution via VimballRecord file.", " - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix", " broken directory deletion code, and refactor code in", " runtime/autoload/vimball.vim", " - CVE-2026-73076", " * SECURITY UPDATE: Arbitrary code execution via keyword lookup.", " - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands", " using single quotes, for sh/zsh pass the argument as a separate list", " item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,", " and ../zsh.vim.", " - CVE-2026-73077", " * SECURITY UPDATE: Code injection in netrw via bookmarks.", " - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in", " runtime/autoload/netrw.vim.", " - CVE-2026-73078", "" ], "package": "vim", "version": "2:9.1.0016-1ubuntu7.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2163785 ], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 14:09:09 -0600" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-headers-6.8.0-138", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162236 ], "changes": [ { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-138.138 -proposed tracker (LP: #2162236)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162236 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:05 +0200" } ], "notes": "linux-headers-6.8.0-138 version '6.8.0-138.138' (source package linux version '6.8.0-138.138') was added. linux-headers-6.8.0-138 version '6.8.0-138.138' has the same source package name, linux, as removed package linux-headers-6.8.0-137. As such we can use the source package version of the removed package, '6.8.0-137.137', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-headers-6.8.0-138-generic", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162236 ], "changes": [ { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-138.138 -proposed tracker (LP: #2162236)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162236 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:05 +0200" } ], "notes": "linux-headers-6.8.0-138-generic version '6.8.0-138.138' (source package linux version '6.8.0-138.138') was added. linux-headers-6.8.0-138-generic version '6.8.0-138.138' has the same source package name, linux, as removed package linux-headers-6.8.0-137. As such we can use the source package version of the removed package, '6.8.0-137.137', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-image-6.8.0-138-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "6.8.0-137.137", "version": null }, "to_version": { "source_package_name": "linux-signed", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 6.8.0-138.138", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:45 +0200" } ], "notes": "linux-image-6.8.0-138-generic version '6.8.0-138.138' (source package linux-signed version '6.8.0-138.138') was added. linux-image-6.8.0-138-generic version '6.8.0-138.138' has the same source package name, linux-signed, as removed package linux-image-6.8.0-137-generic. As such we can use the source package version of the removed package, '6.8.0-137.137', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-6.8.0-138-generic", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162236 ], "changes": [ { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-138.138 -proposed tracker (LP: #2162236)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162236 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:05 +0200" } ], "notes": "linux-modules-6.8.0-138-generic version '6.8.0-138.138' (source package linux version '6.8.0-138.138') was added. linux-modules-6.8.0-138-generic version '6.8.0-138.138' has the same source package name, linux, as removed package linux-headers-6.8.0-137. As such we can use the source package version of the removed package, '6.8.0-137.137', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-6.8.0-138", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162236 ], "changes": [ { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-138.138 -proposed tracker (LP: #2162236)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162236 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:05 +0200" } ], "notes": "linux-tools-6.8.0-138 version '6.8.0-138.138' (source package linux version '6.8.0-138.138') was added. linux-tools-6.8.0-138 version '6.8.0-138.138' has the same source package name, linux, as removed package linux-headers-6.8.0-137. As such we can use the source package version of the removed package, '6.8.0-137.137', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-6.8.0-138-generic", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162236 ], "changes": [ { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-138.138 -proposed tracker (LP: #2162236)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "6.8.0-138.138", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162236 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 22:56:05 +0200" } ], "notes": "linux-tools-6.8.0-138-generic version '6.8.0-138.138' (source package linux version '6.8.0-138.138') was added. linux-tools-6.8.0-138-generic version '6.8.0-138.138' has the same source package name, linux, as removed package linux-headers-6.8.0-137. As such we can use the source package version of the removed package, '6.8.0-137.137', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-headers-6.8.0-137", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-6.8.0-137-generic", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-6.8.0-137-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-6.8.0-137-generic", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-6.8.0-137", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-6.8.0-137-generic", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-137.137", "version": "6.8.0-137.137" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 24.04 noble image from release image serial 20260814 to 20260826", "from_series": "noble", "to_series": "noble", "from_serial": "20260814", "to_serial": "20260826", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }