{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [
                "linux-headers-7.0.0-30",
                "linux-headers-7.0.0-30-generic",
                "linux-image-7.0.0-30-generic",
                "linux-modules-7.0.0-30-generic",
                "linux-tools-7.0.0-30",
                "linux-tools-7.0.0-30-generic"
            ],
            "removed": [
                "linux-headers-7.0.0-28",
                "linux-headers-7.0.0-28-generic",
                "linux-image-7.0.0-28-generic",
                "linux-modules-7.0.0-28-generic",
                "linux-tools-7.0.0-28",
                "linux-tools-7.0.0-28-generic"
            ],
            "diff": [
                "apparmor",
                "bind9-dnsutils",
                "bind9-host",
                "bind9-libs:armhf",
                "bpftool",
                "cloud-init",
                "cloud-init-base",
                "console-setup",
                "console-setup-linux",
                "curl",
                "flash-kernel",
                "gir1.2-packagekitglib-1.0",
                "grub-efi-arm",
                "grub-efi-arm-bin",
                "grub-efi-arm-unsigned",
                "grub2-common",
                "keyboard-configuration",
                "libapparmor1:armhf",
                "libcurl3t64-gnutls:armhf",
                "libcurl4t64:armhf",
                "libnss-systemd:armhf",
                "libpackagekit-glib2-18:armhf",
                "libpam-systemd:armhf",
                "libsystemd-shared:armhf",
                "libsystemd0:armhf",
                "libudev1:armhf",
                "linux-headers-generic",
                "linux-headers-virtual",
                "linux-image-virtual",
                "linux-libc-dev:armhf",
                "linux-tools-common",
                "linux-virtual",
                "packagekit",
                "snapd",
                "systemd",
                "systemd-cryptsetup",
                "systemd-resolved",
                "systemd-sysv",
                "ubuntu-kernel-accessories",
                "ubuntu-minimal",
                "ubuntu-server",
                "ubuntu-standard",
                "udev",
                "vim",
                "vim-common",
                "vim-runtime",
                "vim-tiny",
                "wget",
                "xxd"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "apparmor",
                "from_version": {
                    "source_package_name": "apparmor",
                    "source_package_version": "5.0.0~beta1-0ubuntu7",
                    "version": "5.0.0~beta1-0ubuntu7"
                },
                "to_version": {
                    "source_package_name": "apparmor",
                    "source_package_version": "5.0.2-0ubuntu1~26.04.1",
                    "version": "5.0.2-0ubuntu1~26.04.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2161458,
                    2158941,
                    2158939,
                    2157575,
                    2152079
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * New upstream release (SRU backport). (LP: #2161458)",
                            "  * Upstream release contains fixes for:",
                            "    - uucore locales reads (LP: #2158941)",
                            "    - lsusb uevent file reads (LP: #2158939)",
                            "    - alsamixer asound config reads (LP: #2157575)",
                            "  * d/apparmor.install: add the new glycin.* profiles",
                            "  * d/libapparmor1.symbols: add the new library symbols",
                            "  * d/rules: add profiles check to testing step",
                            "  * d/watch:",
                            "    - Update regex to handle -rc version numbers",
                            "    - Update to version 5 of the format",
                            "  * Refresh patches to apply to upstream release:",
                            "    - d/p/u/profiles-grant-access-to-systemd-resolved.patch",
                            "    - d/p/u/aa-notify-fallback-to-ev-comm-when-ev-execpath.patch",
                            "  * Update patches to apply to upstream release:",
                            "    - d/p/u/samba-systemd-interaction.patch",
                            "    - d/p/u/profiles_disable_curl.patch",
                            "    - d/p/u/profiles_add_more_consoles_workaround.patch",
                            "    - d/p/u/profiles-use-coreutils-tunable.patch",
                            "    - d/p/u/0001-parser-add-more-reserved-mediation-classes.patch",
                            "    - d/p/u/0007-Set-parser-network.h-ip_conds-ptrs-to-null-in-its-fr.patch",
                            "  * Drop patches that were applied upstream:",
                            "    - d/p/u/libapparmor-move-aa_get_lsm_iface-decl-in-libapparmor.patch",
                            "    - d/p/u/0001-parser-set-umask-before-creating-temp-file.patch",
                            "    - d/p/u/0002-parser-restrict-umask-to-allow-only-user-permissions.patch",
                            "    - d/p/u/libapparmor-add-test-for-libapparmor-features-prefix.patch",
                            "    - d/p/u/transmission-common-fixes-for-lp-2137395.patch",
                            "    - d/p/u/unix-chkpwd-add-disconnected-run-paths.patch",
                            "    - d/p/u/profiles-add-extensions-to-allowed-ghostscript.patch",
                            "    - d/p/u/profiles-expand-the-allowed-directories-for-ghostscript.patch",
                            "    - d/p/u/profiles-add-sys-kernel-mm-transparent_hugepage-enable.patch",
                            "    - d/p/u/0006-parser-name-ns_domain-and-network_v9-classes.patch",
                            "    - d/p/u/0011-utils-add-support-for-iface-an-label-in-network-rule.patch",
                            "    - d/p/u/0013-parser-fix-FTBFS-due-to-missing-merge-edit.patch",
                            "    - d/p/u/0014-tests-check-if-skb-mediation-is-enabled.patch",
                            "    - d/p/u/snap-browser-add-missing-perms-when-opening-from-link.patch",
                            "    - d/p/u/lsusb-allow-reading-etc-udev-hwdb-bin.patch",
                            "    - d/p/u/profiles-grant-unix-domain-socket-access-to-sanitize.patch",
                            "    - d/p/u/0002-parser-refactor-compressed-policy-cache.patch",
                            "    - d/p/u/0003-parser-handle-compressed-cache-on-kernels-without-de.patch",
                            "    - d/p/u/0004-regression-fix-the-e2e-test-for-compressed-caches.patch",
                            "  * Drop patches that were superseded upstream:",
                            "    - d/p/u/0002-parser-convert-conditionals-operators-to-an-enum.patch",
                            "    - d/p/u/0003-parser-add-override-assign-to-cond-list-elements.patch",
                            "    - d/p/u/0004-parser-support-network-interface-conditional.patch",
                            "    - d/p/u/0005-tests-add-network-interface-tests.patch",
                            "    - d/p/u/0008-parser-move-to-encode-an-alternation-of-a-null-trans.patch",
                            "    - d/p/u/0009-parser-disable-ability-to-specify-interface-on-peer-.patch",
                            "    - d/p/u/0010-parser-fix-iface-perms-to-work-when-v9-and-v9_skb-ar.patch",
                            "    - d/p/u/0012-parser-fix-label-match-for-default-label-values.patch",
                            "    - d/p/u/0001-parser-fix-rewriting-of-cache-after-zstd-recompressi.patch",
                            "  * Add patches to fix FTBFS (profile test enabling):",
                            "    - d/p/u/profiles-allow-more-attach-disconnected.patch",
                            "  * Update patches to fix FTBFS (profile test enabling):",
                            "    - d/p/u/openvpn_mr_1263.patch",
                            "    - d/p/u/irssi_mr_1332.patch",
                            "    - d/p/u/os_prober_mr_1569.patch",
                            "    - d/p/u/profiles_disable_free.patch",
                            "    - d/p/u/profiles_disable_curl.patch",
                            "    - d/p/u/profiles-tunables-add-coreutils-var.patch",
                            "    - d/p/u/profiles-use-coreutils-tunable.patch",
                            "    - d/p/u/profiles-pull-openvpn-profile.patch",
                            "  * Add patch to fix transmission-gtk file chooser (LP: #2152079):",
                            "    - d/p/u/profiles-add-file-chooser-rules-to-abstractions-trans.patch",
                            ""
                        ],
                        "package": "apparmor",
                        "version": "5.0.2-0ubuntu1~26.04.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2161458,
                            2158941,
                            2158939,
                            2157575,
                            2152079
                        ],
                        "author": "Ryan Lee <ryan.lee@canonical.com>",
                        "date": "Mon, 13 Jul 2026 10:43:46 -0700"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "bind9-dnsutils",
                "from_version": {
                    "source_package_name": "bind9",
                    "source_package_version": "1:9.20.18-1ubuntu2.1",
                    "version": "1:9.20.18-1ubuntu2.1"
                },
                "to_version": {
                    "source_package_name": "bind9",
                    "source_package_version": "1:9.20.24-1ubuntu0.2",
                    "version": "1:9.20.24-1ubuntu0.2"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-10723",
                        "url": "https://ubuntu.com/security/CVE-2026-10723",
                        "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-10822",
                        "url": "https://ubuntu.com/security/CVE-2026-10822",
                        "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.  BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11331",
                        "url": "https://ubuntu.com/security/CVE-2026-11331",
                        "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11605",
                        "url": "https://ubuntu.com/security/CVE-2026-11605",
                        "cve_description": "The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11622",
                        "url": "https://ubuntu.com/security/CVE-2026-11622",
                        "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11721",
                        "url": "https://ubuntu.com/security/CVE-2026-11721",
                        "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-12617",
                        "url": "https://ubuntu.com/security/CVE-2026-12617",
                        "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-13321",
                        "url": "https://ubuntu.com/security/CVE-2026-13321",
                        "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-1519",
                        "url": "https://ubuntu.com/security/CVE-2026-1519",
                        "cve_description": "If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3104",
                        "url": "https://ubuntu.com/security/CVE-2026-3104",
                        "cve_description": "A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3119",
                        "url": "https://ubuntu.com/security/CVE-2026-3119",
                        "cve_description": "Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3591",
                        "url": "https://ubuntu.com/security/CVE-2026-3591",
                        "cve_description": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3039",
                        "url": "https://ubuntu.com/security/CVE-2026-3039",
                        "cve_description": "BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.  Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3592",
                        "url": "https://ubuntu.com/security/CVE-2026-3592",
                        "cve_description": "BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3593",
                        "url": "https://ubuntu.com/security/CVE-2026-3593",
                        "cve_description": "A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-5946",
                        "url": "https://ubuntu.com/security/CVE-2026-5946",
                        "cve_description": "Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-5947",
                        "url": "https://ubuntu.com/security/CVE-2026-5947",
                        "cve_description": "Undefined behavior may result due to a race condition leading to a use-after-free violation.  If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature.  If, during that validation, the \"recursive-clients\" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-5950",
                        "url": "https://ubuntu.com/security/CVE-2026-5950",
                        "cve_description": "An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2126464
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-10723",
                                "url": "https://ubuntu.com/security/CVE-2026-10723",
                                "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-10822",
                                "url": "https://ubuntu.com/security/CVE-2026-10822",
                                "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.  BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11331",
                                "url": "https://ubuntu.com/security/CVE-2026-11331",
                                "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11605",
                                "url": "https://ubuntu.com/security/CVE-2026-11605",
                                "cve_description": "The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11622",
                                "url": "https://ubuntu.com/security/CVE-2026-11622",
                                "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11721",
                                "url": "https://ubuntu.com/security/CVE-2026-11721",
                                "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-12617",
                                "url": "https://ubuntu.com/security/CVE-2026-12617",
                                "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-13321",
                                "url": "https://ubuntu.com/security/CVE-2026-13321",
                                "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Incorrect acceptance of NSEC3 records",
                            "    - debian/patches/CVE-2026-10723-1.patch: Check NSEC3 signer matches the",
                            "      owning zone in lib/dns/dnssec.c, lib/isc/result.c.",
                            "    - debian/patches/CVE-2026-10723-2.patch: Reproducer for #5874 NSEC3",
                            "      impersonation in bin/tests/system/repro_5874_nsec3_parent/ans1/ans.py,",
                            "      bin/tests/system/repro_5874_nsec3_parent/ns2/named.conf.j2,",
                            "      bin/tests/system/repro_5874_nsec3_parent/server.py,",
                            "      bin/tests/system/repro_5874_nsec3_parent/tests_repro_5874_nsec3_parent.py.",
                            "    - debian/patches/CVE-2026-10723-3.patch: Update reproducer #5874 in",
                            "      bin/tests/system/nsec3_impersonation/ans1/ans.py,",
                            "      bin/tests/system/nsec3_impersonation/ns2/named.conf.j2,",
                            "      bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py.",
                            "    - CVE-2026-10723",
                            "  * SECURITY UPDATE: Key Record using PRIVATEDNS algorithm may lead to",
                            "    unexpected exit",
                            "    - debian/patches/CVE-2026-10822-1.patch: Check that dns_name_fromwire",
                            "      honours the active region in tests/dns/name_test.c.",
                            "    - debian/patches/CVE-2026-10822-2.patch: Fix the yaml query zone name code",
                            "      in dnstap-read in bin/tools/dnstap-read.c.",
                            "    - debian/patches/CVE-2026-10822-3.patch: Fix dns_name_fromwire to honour the",
                            "      active region in lib/dns/name.c.",
                            "    - debian/patches/CVE-2026-10822-4.patch: Make it clearer that decompression",
                            "      is not allowed here in lib/dns/rdata.c.",
                            "    - debian/patches/CVE-2026-10822-5.patch: Check that a short PRIVATEDNS",
                            "      record is rejected in tests/dns/rdata_test.c.",
                            "    - CVE-2026-10822",
                            "  * SECURITY UPDATE: Potential wildcard CNAME RPZ policy bypass",
                            "    - debian/patches/CVE-2026-11331-1.patch: Fix TTL extraction from A/AAAA",
                            "      record in bin/tests/system/rpz/tests.sh.",
                            "    - debian/patches/CVE-2026-11331-2.patch: Check rpz name too long wildcard",
                            "      CNAME expansion handling in bin/tests/system/rpz/ns2/tld2.db,",
                            "      bin/tests/system/rpz/ns4/tld4.db, bin/tests/system/rpz/tests.sh.",
                            "    - debian/patches/CVE-2026-11331-3.patch: Properly handle rpz name to long",
                            "      wildcard expansion in lib/ns/query.c.",
                            "    - CVE-2026-11331",
                            "  * SECURITY UPDATE: Unnecessary validation of DNSSEC signed records",
                            "    - debian/patches/CVE-2026-11605-1.patch: Limit DNSSEC denial proof",
                            "      validation per fetch in lib/dns/validator.c.",
                            "    - CVE-2026-11605",
                            "  * SECURITY UPDATE: Potential memory usage beyond configured limits",
                            "    - debian/patches/CVE-2026-11622.patch: Make the dns_slabheaders in the cache",
                            "      reference counted in bin/tests/system/reclimit/tests.sh,",
                            "      lib/dns/include/dns/rdataslab.h, lib/dns/qpcache.c, lib/dns/qpzone.c,",
                            "      lib/dns/rbt-cachedb.c, lib/dns/rbtdb.c, lib/dns/rbtdb_p.h,",
                            "      lib/dns/rdataslab.c.",
                            "    - CVE-2026-11622",
                            "  * SECURITY UPDATE: Cache poisoning possible with label count discrepancy,",
                            "    RRSIG, and wildcards",
                            "    - debian/patches/CVE-2026-11721-1.patch: Don't sign out of zone records in",
                            "      dnssec-signzone in bin/dnssec/dnssec-signzone.c.",
                            "    - debian/patches/CVE-2026-11721-2.patch: Invalid signed wildcard records",
                            "      were being accepted in lib/dns/dnssec.c, lib/dns/rdata/generic/rrsig_46.c.",
                            "    - debian/patches/CVE-2026-11721-3.patch: Test RRSIG record parsing in",
                            "      tests/dns/rdata_test.c.",
                            "    - CVE-2026-11721",
                            "  * SECURITY UPDATE:Record ordering based unexpected exit with CNAME or DNAME",
                            "    - debian/patches/CVE-2026-12617-1.patch: Do not assert in some CNAME/DNAME",
                            "      queries in lib/dns/resolver.c.",
                            "    - debian/patches/CVE-2026-12617-2.patch: Reproducer for #5946 (assertion in",
                            "      some CNAME/DNAME queries) in",
                            "      bin/tests/system/cname_dname_negcache/ans2/ans.py,",
                            "      bin/tests/system/cname_dname_negcache/ns1/bar.test.db,",
                            "      bin/tests/system/cname_dname_negcache/ns1/named.conf.j2,",
                            "      bin/tests/system/cname_dname_negcache/ns1/root.db,",
                            "      bin/tests/system/cname_dname_negcache/ns1/test.db,",
                            "      bin/tests/system/cname_dname_negcache/ns3/named.conf.j2,",
                            "      bin/tests/system/cname_dname_negcache/tests_cname_dname_negcache.py.",
                            "    - CVE-2026-12617",
                            "  * SECURITY UPDATE: Record ordering based unexpected exit with CNAME or DNAME",
                            "    - debian/patches/CVE-2026-13321-1.patch: Add system test for out-of-zone",
                            "      nsec dnssec bypass in bin/tests/system/dnssec_bypass/ns1/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/ns1/root.db,",
                            "      bin/tests/system/dnssec_bypass/ns1/test.db,",
                            "      bin/tests/system/dnssec_bypass/ns2/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/ns2/victim.db,",
                            "      bin/tests/system/dnssec_bypass/ns3/evil.db,",
                            "      bin/tests/system/dnssec_bypass/ns3/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/ns4/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/tests_bypass.py.",
                            "    - debian/patches/CVE-2026-13321-2.patch: Reject out-of-zone NSEC next owner",
                            "      names in lib/dns/dnssec.c, lib/dns/include/dns/dnssec.h.",
                            "    - debian/patches/CVE-2026-13321-3.patch: change",
                            "      dns_nsec_requiredtypespresent to dns_nsec_is_legal in",
                            "      lib/dns/include/dns/nsec.h, lib/dns/nsec.c, lib/dns/resolver.c,",
                            "      lib/ns/query.c.",
                            "    - CVE-2026-13321",
                            ""
                        ],
                        "package": "bind9",
                        "version": "1:9.20.24-1ubuntu0.2",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Wed, 29 Jul 2026 11:42:56 -0400"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-1519",
                                "url": "https://ubuntu.com/security/CVE-2026-1519",
                                "cve_description": "If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3104",
                                "url": "https://ubuntu.com/security/CVE-2026-3104",
                                "cve_description": "A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3119",
                                "url": "https://ubuntu.com/security/CVE-2026-3119",
                                "cve_description": "Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3591",
                                "url": "https://ubuntu.com/security/CVE-2026-3591",
                                "cve_description": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3039",
                                "url": "https://ubuntu.com/security/CVE-2026-3039",
                                "cve_description": "BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.  Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3592",
                                "url": "https://ubuntu.com/security/CVE-2026-3592",
                                "cve_description": "BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3593",
                                "url": "https://ubuntu.com/security/CVE-2026-3593",
                                "cve_description": "A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-5946",
                                "url": "https://ubuntu.com/security/CVE-2026-5946",
                                "cve_description": "Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-5947",
                                "url": "https://ubuntu.com/security/CVE-2026-5947",
                                "cve_description": "Undefined behavior may result due to a race condition leading to a use-after-free violation.  If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature.  If, during that validation, the \"recursive-clients\" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-5950",
                                "url": "https://ubuntu.com/security/CVE-2026-5950",
                                "cve_description": "An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * New upstream release 9.20.24 (LP: #2126464)",
                            "    - Updates:",
                            "      + Remove the ineffective TCP fallback after repeated UDP timeouts.",
                            "      + Fall back to TCP on receipt of a UDP response with mismatched query ID.",
                            "      + Limit glue records cached from a referral per nameserver.",
                            "      + Reject a CNAME response to a DS query promptly.",
                            "      + Spread cache cleanup probabilistically to avoid CPU spikes and slow",
                            "        queries when the cache approaches its memory limit.",
                            "      + Record query time for all dnstap responses.",
                            "      + Optimize TCP source port selection on Linux via IP_LOCAL_PORT_RANGE.",
                            "      + Use the zone file's basename as origin in dnssec-signzone and",
                            "        dnssec-verify.",
                            "      + Implement seamless outgoing TCP connection reuse with pipelined queries",
                            "        per connection capped at 256.",
                            "      + Randomize nameserver selection.",
                            "      + Make catalog zone names and member zones' entry names case-insensitive.",
                            "    - Bug fixes:",
                            "      + Remove other RRsets at the same name when caching a CNAME.",
                            "      + Fix nxdomain-redirect combined with dns64.",
                            "      + Fix DNS64 owner-name case after a DNAME restart.",
                            "      + Clear the REDIRECT flag when it isn't needed.",
                            "      + Disable output escaping in bind9.xsl.",
                            "      + Fix crash on badly configured secondary signer missing the file entry.",
                            "      + Fix possible crash on concurrent TKEY DELETE for the same key.",
                            "      + Reject RRSIG records covering meta-types ANY, AXFR, IXFR, MAILA, MAILB.",
                            "      + Fix possible race condition during zone transfers.",
                            "      + Fix named crash when processing SIG records in dynamic updates.",
                            "      + Fix zone verification of NSEC3 signed zones.",
                            "      + Prevent a crash when using both dns64 and filter-aaaa.",
                            "      + Fix assertion failure when processing catalog zones with invalid TSIG",
                            "        key name.",
                            "      + Prevent malicious DNSSEC zones from exhausting validator CPU by",
                            "        rejecting DNSKEYs with oversized RSA public exponent.",
                            "      + Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits.",
                            "      + Prevent crafted queries from degrading RRL performance via",
                            "        per-process keyed hash.",
                            "      + Prevent rare named crash when notifies are cancelled.",
                            "      + Stop delv from aborting on malformed query name.",
                            "      + Fix crash when reconfiguring while an NTA is being rechecked.",
                            "      + Fix bug in allow-query/allow-transfer catalog zone custom properties.",
                            "      + Fix memory leak in catalog zones.",
                            "      + Fix suppressed missing-glue check in named-checkzone.",
                            "      + Reject record sets too large to serve in DNS at storage time.",
                            "      + Fix intermittent named crashes during asynchronous zone operations by",
                            "        enforcing loop affinity.",
                            "      + Count temporal DNSSEC validation problems as validation attempts.",
                            "      + Fix possible deadlock in RPZ processing.",
                            "      + Fix crash triggered by rndc modzone on a zone from a configuration",
                            "        file.",
                            "      + Fix processing of empty catalog zone ACLs.",
                            "      + Fix crash triggered by rndc modzone on a zone that already existed in",
                            "        NZF file.",
                            "      + Fix potential resource leak during resolver error handling.",
                            "      + Fix handling of key statements defined inside views.",
                            "      + Fix use-after-free in dns_client_resolve() triggered by a DNAME",
                            "        response.",
                            "      + Fix assertion failure triggered by non-minimal IXFRs.",
                            "      + Fix crash when retrying a NOTIFY over TCP.",
                            "      + Improve fetch loop detection for an in-domain nameserver with expired",
                            "        glue.",
                            "      + Fix dnstap logging of forwarded queries.",
                            "      + Fix stale answer being served on multiple upstream failures when",
                            "        following CNAME chains.",
                            "      + Fail DNSKEY validation when supported but invalid DS is found..",
                            "      + Fix stack memory corruption when importing invalid SKR file.",
                            "      + Return FORMERR for queries with EDNS Client Subnet FAMILY field set to",
                            "        0.",
                            "      + Fix inbound IXFR performance regression where very large IXFR",
                            "        transfers were much slower than in 9.18.",
                            "      + Fix implementation of BRID and HHIT record types.",
                            "      + Fix implementation of DSYNC record type.",
                            "      + Fix response policy and catalog zones to work with INCLUDE directive.",
                            "    - Remove CVE patches fixed upstream",
                            "      + CVE-2026-1519-*.patch",
                            "      + CVE-2026-3104-*.patch",
                            "      + CVE-2026-3119-*.patch",
                            "      + CVE-2026-3591-*.patch",
                            "      [Fixed in 9.20.21]",
                            "      + CVE-2026-3039-*.patch",
                            "      + CVE-2026-3592-*.patch",
                            "      + CVE-2026-3593-*.patch",
                            "      + CVE-2026-5946-*.patch",
                            "      + CVE-2026-5947.patch",
                            "      + CVE-2026-5950-*.patch",
                            "      [Fixed in 9.20.23]",
                            ""
                        ],
                        "package": "bind9",
                        "version": "1:9.20.24-1ubuntu0.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2126464
                        ],
                        "author": "Lena Voytek <lena.voytek@canonical.com>",
                        "date": "Mon, 13 Jul 2026 14:38:03 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "bind9-host",
                "from_version": {
                    "source_package_name": "bind9",
                    "source_package_version": "1:9.20.18-1ubuntu2.1",
                    "version": "1:9.20.18-1ubuntu2.1"
                },
                "to_version": {
                    "source_package_name": "bind9",
                    "source_package_version": "1:9.20.24-1ubuntu0.2",
                    "version": "1:9.20.24-1ubuntu0.2"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-10723",
                        "url": "https://ubuntu.com/security/CVE-2026-10723",
                        "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-10822",
                        "url": "https://ubuntu.com/security/CVE-2026-10822",
                        "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.  BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11331",
                        "url": "https://ubuntu.com/security/CVE-2026-11331",
                        "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11605",
                        "url": "https://ubuntu.com/security/CVE-2026-11605",
                        "cve_description": "The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11622",
                        "url": "https://ubuntu.com/security/CVE-2026-11622",
                        "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11721",
                        "url": "https://ubuntu.com/security/CVE-2026-11721",
                        "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-12617",
                        "url": "https://ubuntu.com/security/CVE-2026-12617",
                        "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-13321",
                        "url": "https://ubuntu.com/security/CVE-2026-13321",
                        "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-1519",
                        "url": "https://ubuntu.com/security/CVE-2026-1519",
                        "cve_description": "If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3104",
                        "url": "https://ubuntu.com/security/CVE-2026-3104",
                        "cve_description": "A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3119",
                        "url": "https://ubuntu.com/security/CVE-2026-3119",
                        "cve_description": "Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3591",
                        "url": "https://ubuntu.com/security/CVE-2026-3591",
                        "cve_description": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3039",
                        "url": "https://ubuntu.com/security/CVE-2026-3039",
                        "cve_description": "BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.  Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3592",
                        "url": "https://ubuntu.com/security/CVE-2026-3592",
                        "cve_description": "BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3593",
                        "url": "https://ubuntu.com/security/CVE-2026-3593",
                        "cve_description": "A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-5946",
                        "url": "https://ubuntu.com/security/CVE-2026-5946",
                        "cve_description": "Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-5947",
                        "url": "https://ubuntu.com/security/CVE-2026-5947",
                        "cve_description": "Undefined behavior may result due to a race condition leading to a use-after-free violation.  If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature.  If, during that validation, the \"recursive-clients\" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-5950",
                        "url": "https://ubuntu.com/security/CVE-2026-5950",
                        "cve_description": "An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2126464
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-10723",
                                "url": "https://ubuntu.com/security/CVE-2026-10723",
                                "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-10822",
                                "url": "https://ubuntu.com/security/CVE-2026-10822",
                                "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.  BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11331",
                                "url": "https://ubuntu.com/security/CVE-2026-11331",
                                "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11605",
                                "url": "https://ubuntu.com/security/CVE-2026-11605",
                                "cve_description": "The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11622",
                                "url": "https://ubuntu.com/security/CVE-2026-11622",
                                "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11721",
                                "url": "https://ubuntu.com/security/CVE-2026-11721",
                                "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-12617",
                                "url": "https://ubuntu.com/security/CVE-2026-12617",
                                "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-13321",
                                "url": "https://ubuntu.com/security/CVE-2026-13321",
                                "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Incorrect acceptance of NSEC3 records",
                            "    - debian/patches/CVE-2026-10723-1.patch: Check NSEC3 signer matches the",
                            "      owning zone in lib/dns/dnssec.c, lib/isc/result.c.",
                            "    - debian/patches/CVE-2026-10723-2.patch: Reproducer for #5874 NSEC3",
                            "      impersonation in bin/tests/system/repro_5874_nsec3_parent/ans1/ans.py,",
                            "      bin/tests/system/repro_5874_nsec3_parent/ns2/named.conf.j2,",
                            "      bin/tests/system/repro_5874_nsec3_parent/server.py,",
                            "      bin/tests/system/repro_5874_nsec3_parent/tests_repro_5874_nsec3_parent.py.",
                            "    - debian/patches/CVE-2026-10723-3.patch: Update reproducer #5874 in",
                            "      bin/tests/system/nsec3_impersonation/ans1/ans.py,",
                            "      bin/tests/system/nsec3_impersonation/ns2/named.conf.j2,",
                            "      bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py.",
                            "    - CVE-2026-10723",
                            "  * SECURITY UPDATE: Key Record using PRIVATEDNS algorithm may lead to",
                            "    unexpected exit",
                            "    - debian/patches/CVE-2026-10822-1.patch: Check that dns_name_fromwire",
                            "      honours the active region in tests/dns/name_test.c.",
                            "    - debian/patches/CVE-2026-10822-2.patch: Fix the yaml query zone name code",
                            "      in dnstap-read in bin/tools/dnstap-read.c.",
                            "    - debian/patches/CVE-2026-10822-3.patch: Fix dns_name_fromwire to honour the",
                            "      active region in lib/dns/name.c.",
                            "    - debian/patches/CVE-2026-10822-4.patch: Make it clearer that decompression",
                            "      is not allowed here in lib/dns/rdata.c.",
                            "    - debian/patches/CVE-2026-10822-5.patch: Check that a short PRIVATEDNS",
                            "      record is rejected in tests/dns/rdata_test.c.",
                            "    - CVE-2026-10822",
                            "  * SECURITY UPDATE: Potential wildcard CNAME RPZ policy bypass",
                            "    - debian/patches/CVE-2026-11331-1.patch: Fix TTL extraction from A/AAAA",
                            "      record in bin/tests/system/rpz/tests.sh.",
                            "    - debian/patches/CVE-2026-11331-2.patch: Check rpz name too long wildcard",
                            "      CNAME expansion handling in bin/tests/system/rpz/ns2/tld2.db,",
                            "      bin/tests/system/rpz/ns4/tld4.db, bin/tests/system/rpz/tests.sh.",
                            "    - debian/patches/CVE-2026-11331-3.patch: Properly handle rpz name to long",
                            "      wildcard expansion in lib/ns/query.c.",
                            "    - CVE-2026-11331",
                            "  * SECURITY UPDATE: Unnecessary validation of DNSSEC signed records",
                            "    - debian/patches/CVE-2026-11605-1.patch: Limit DNSSEC denial proof",
                            "      validation per fetch in lib/dns/validator.c.",
                            "    - CVE-2026-11605",
                            "  * SECURITY UPDATE: Potential memory usage beyond configured limits",
                            "    - debian/patches/CVE-2026-11622.patch: Make the dns_slabheaders in the cache",
                            "      reference counted in bin/tests/system/reclimit/tests.sh,",
                            "      lib/dns/include/dns/rdataslab.h, lib/dns/qpcache.c, lib/dns/qpzone.c,",
                            "      lib/dns/rbt-cachedb.c, lib/dns/rbtdb.c, lib/dns/rbtdb_p.h,",
                            "      lib/dns/rdataslab.c.",
                            "    - CVE-2026-11622",
                            "  * SECURITY UPDATE: Cache poisoning possible with label count discrepancy,",
                            "    RRSIG, and wildcards",
                            "    - debian/patches/CVE-2026-11721-1.patch: Don't sign out of zone records in",
                            "      dnssec-signzone in bin/dnssec/dnssec-signzone.c.",
                            "    - debian/patches/CVE-2026-11721-2.patch: Invalid signed wildcard records",
                            "      were being accepted in lib/dns/dnssec.c, lib/dns/rdata/generic/rrsig_46.c.",
                            "    - debian/patches/CVE-2026-11721-3.patch: Test RRSIG record parsing in",
                            "      tests/dns/rdata_test.c.",
                            "    - CVE-2026-11721",
                            "  * SECURITY UPDATE:Record ordering based unexpected exit with CNAME or DNAME",
                            "    - debian/patches/CVE-2026-12617-1.patch: Do not assert in some CNAME/DNAME",
                            "      queries in lib/dns/resolver.c.",
                            "    - debian/patches/CVE-2026-12617-2.patch: Reproducer for #5946 (assertion in",
                            "      some CNAME/DNAME queries) in",
                            "      bin/tests/system/cname_dname_negcache/ans2/ans.py,",
                            "      bin/tests/system/cname_dname_negcache/ns1/bar.test.db,",
                            "      bin/tests/system/cname_dname_negcache/ns1/named.conf.j2,",
                            "      bin/tests/system/cname_dname_negcache/ns1/root.db,",
                            "      bin/tests/system/cname_dname_negcache/ns1/test.db,",
                            "      bin/tests/system/cname_dname_negcache/ns3/named.conf.j2,",
                            "      bin/tests/system/cname_dname_negcache/tests_cname_dname_negcache.py.",
                            "    - CVE-2026-12617",
                            "  * SECURITY UPDATE: Record ordering based unexpected exit with CNAME or DNAME",
                            "    - debian/patches/CVE-2026-13321-1.patch: Add system test for out-of-zone",
                            "      nsec dnssec bypass in bin/tests/system/dnssec_bypass/ns1/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/ns1/root.db,",
                            "      bin/tests/system/dnssec_bypass/ns1/test.db,",
                            "      bin/tests/system/dnssec_bypass/ns2/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/ns2/victim.db,",
                            "      bin/tests/system/dnssec_bypass/ns3/evil.db,",
                            "      bin/tests/system/dnssec_bypass/ns3/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/ns4/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/tests_bypass.py.",
                            "    - debian/patches/CVE-2026-13321-2.patch: Reject out-of-zone NSEC next owner",
                            "      names in lib/dns/dnssec.c, lib/dns/include/dns/dnssec.h.",
                            "    - debian/patches/CVE-2026-13321-3.patch: change",
                            "      dns_nsec_requiredtypespresent to dns_nsec_is_legal in",
                            "      lib/dns/include/dns/nsec.h, lib/dns/nsec.c, lib/dns/resolver.c,",
                            "      lib/ns/query.c.",
                            "    - CVE-2026-13321",
                            ""
                        ],
                        "package": "bind9",
                        "version": "1:9.20.24-1ubuntu0.2",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Wed, 29 Jul 2026 11:42:56 -0400"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-1519",
                                "url": "https://ubuntu.com/security/CVE-2026-1519",
                                "cve_description": "If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3104",
                                "url": "https://ubuntu.com/security/CVE-2026-3104",
                                "cve_description": "A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3119",
                                "url": "https://ubuntu.com/security/CVE-2026-3119",
                                "cve_description": "Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3591",
                                "url": "https://ubuntu.com/security/CVE-2026-3591",
                                "cve_description": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3039",
                                "url": "https://ubuntu.com/security/CVE-2026-3039",
                                "cve_description": "BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.  Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3592",
                                "url": "https://ubuntu.com/security/CVE-2026-3592",
                                "cve_description": "BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3593",
                                "url": "https://ubuntu.com/security/CVE-2026-3593",
                                "cve_description": "A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-5946",
                                "url": "https://ubuntu.com/security/CVE-2026-5946",
                                "cve_description": "Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-5947",
                                "url": "https://ubuntu.com/security/CVE-2026-5947",
                                "cve_description": "Undefined behavior may result due to a race condition leading to a use-after-free violation.  If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature.  If, during that validation, the \"recursive-clients\" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-5950",
                                "url": "https://ubuntu.com/security/CVE-2026-5950",
                                "cve_description": "An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * New upstream release 9.20.24 (LP: #2126464)",
                            "    - Updates:",
                            "      + Remove the ineffective TCP fallback after repeated UDP timeouts.",
                            "      + Fall back to TCP on receipt of a UDP response with mismatched query ID.",
                            "      + Limit glue records cached from a referral per nameserver.",
                            "      + Reject a CNAME response to a DS query promptly.",
                            "      + Spread cache cleanup probabilistically to avoid CPU spikes and slow",
                            "        queries when the cache approaches its memory limit.",
                            "      + Record query time for all dnstap responses.",
                            "      + Optimize TCP source port selection on Linux via IP_LOCAL_PORT_RANGE.",
                            "      + Use the zone file's basename as origin in dnssec-signzone and",
                            "        dnssec-verify.",
                            "      + Implement seamless outgoing TCP connection reuse with pipelined queries",
                            "        per connection capped at 256.",
                            "      + Randomize nameserver selection.",
                            "      + Make catalog zone names and member zones' entry names case-insensitive.",
                            "    - Bug fixes:",
                            "      + Remove other RRsets at the same name when caching a CNAME.",
                            "      + Fix nxdomain-redirect combined with dns64.",
                            "      + Fix DNS64 owner-name case after a DNAME restart.",
                            "      + Clear the REDIRECT flag when it isn't needed.",
                            "      + Disable output escaping in bind9.xsl.",
                            "      + Fix crash on badly configured secondary signer missing the file entry.",
                            "      + Fix possible crash on concurrent TKEY DELETE for the same key.",
                            "      + Reject RRSIG records covering meta-types ANY, AXFR, IXFR, MAILA, MAILB.",
                            "      + Fix possible race condition during zone transfers.",
                            "      + Fix named crash when processing SIG records in dynamic updates.",
                            "      + Fix zone verification of NSEC3 signed zones.",
                            "      + Prevent a crash when using both dns64 and filter-aaaa.",
                            "      + Fix assertion failure when processing catalog zones with invalid TSIG",
                            "        key name.",
                            "      + Prevent malicious DNSSEC zones from exhausting validator CPU by",
                            "        rejecting DNSKEYs with oversized RSA public exponent.",
                            "      + Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits.",
                            "      + Prevent crafted queries from degrading RRL performance via",
                            "        per-process keyed hash.",
                            "      + Prevent rare named crash when notifies are cancelled.",
                            "      + Stop delv from aborting on malformed query name.",
                            "      + Fix crash when reconfiguring while an NTA is being rechecked.",
                            "      + Fix bug in allow-query/allow-transfer catalog zone custom properties.",
                            "      + Fix memory leak in catalog zones.",
                            "      + Fix suppressed missing-glue check in named-checkzone.",
                            "      + Reject record sets too large to serve in DNS at storage time.",
                            "      + Fix intermittent named crashes during asynchronous zone operations by",
                            "        enforcing loop affinity.",
                            "      + Count temporal DNSSEC validation problems as validation attempts.",
                            "      + Fix possible deadlock in RPZ processing.",
                            "      + Fix crash triggered by rndc modzone on a zone from a configuration",
                            "        file.",
                            "      + Fix processing of empty catalog zone ACLs.",
                            "      + Fix crash triggered by rndc modzone on a zone that already existed in",
                            "        NZF file.",
                            "      + Fix potential resource leak during resolver error handling.",
                            "      + Fix handling of key statements defined inside views.",
                            "      + Fix use-after-free in dns_client_resolve() triggered by a DNAME",
                            "        response.",
                            "      + Fix assertion failure triggered by non-minimal IXFRs.",
                            "      + Fix crash when retrying a NOTIFY over TCP.",
                            "      + Improve fetch loop detection for an in-domain nameserver with expired",
                            "        glue.",
                            "      + Fix dnstap logging of forwarded queries.",
                            "      + Fix stale answer being served on multiple upstream failures when",
                            "        following CNAME chains.",
                            "      + Fail DNSKEY validation when supported but invalid DS is found..",
                            "      + Fix stack memory corruption when importing invalid SKR file.",
                            "      + Return FORMERR for queries with EDNS Client Subnet FAMILY field set to",
                            "        0.",
                            "      + Fix inbound IXFR performance regression where very large IXFR",
                            "        transfers were much slower than in 9.18.",
                            "      + Fix implementation of BRID and HHIT record types.",
                            "      + Fix implementation of DSYNC record type.",
                            "      + Fix response policy and catalog zones to work with INCLUDE directive.",
                            "    - Remove CVE patches fixed upstream",
                            "      + CVE-2026-1519-*.patch",
                            "      + CVE-2026-3104-*.patch",
                            "      + CVE-2026-3119-*.patch",
                            "      + CVE-2026-3591-*.patch",
                            "      [Fixed in 9.20.21]",
                            "      + CVE-2026-3039-*.patch",
                            "      + CVE-2026-3592-*.patch",
                            "      + CVE-2026-3593-*.patch",
                            "      + CVE-2026-5946-*.patch",
                            "      + CVE-2026-5947.patch",
                            "      + CVE-2026-5950-*.patch",
                            "      [Fixed in 9.20.23]",
                            ""
                        ],
                        "package": "bind9",
                        "version": "1:9.20.24-1ubuntu0.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2126464
                        ],
                        "author": "Lena Voytek <lena.voytek@canonical.com>",
                        "date": "Mon, 13 Jul 2026 14:38:03 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "bind9-libs:armhf",
                "from_version": {
                    "source_package_name": "bind9",
                    "source_package_version": "1:9.20.18-1ubuntu2.1",
                    "version": "1:9.20.18-1ubuntu2.1"
                },
                "to_version": {
                    "source_package_name": "bind9",
                    "source_package_version": "1:9.20.24-1ubuntu0.2",
                    "version": "1:9.20.24-1ubuntu0.2"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-10723",
                        "url": "https://ubuntu.com/security/CVE-2026-10723",
                        "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-10822",
                        "url": "https://ubuntu.com/security/CVE-2026-10822",
                        "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.  BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11331",
                        "url": "https://ubuntu.com/security/CVE-2026-11331",
                        "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11605",
                        "url": "https://ubuntu.com/security/CVE-2026-11605",
                        "cve_description": "The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11622",
                        "url": "https://ubuntu.com/security/CVE-2026-11622",
                        "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-11721",
                        "url": "https://ubuntu.com/security/CVE-2026-11721",
                        "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-12617",
                        "url": "https://ubuntu.com/security/CVE-2026-12617",
                        "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-13321",
                        "url": "https://ubuntu.com/security/CVE-2026-13321",
                        "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-22 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-1519",
                        "url": "https://ubuntu.com/security/CVE-2026-1519",
                        "cve_description": "If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3104",
                        "url": "https://ubuntu.com/security/CVE-2026-3104",
                        "cve_description": "A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3119",
                        "url": "https://ubuntu.com/security/CVE-2026-3119",
                        "cve_description": "Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3591",
                        "url": "https://ubuntu.com/security/CVE-2026-3591",
                        "cve_description": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-03-25 14:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3039",
                        "url": "https://ubuntu.com/security/CVE-2026-3039",
                        "cve_description": "BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.  Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3592",
                        "url": "https://ubuntu.com/security/CVE-2026-3592",
                        "cve_description": "BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3593",
                        "url": "https://ubuntu.com/security/CVE-2026-3593",
                        "cve_description": "A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-5946",
                        "url": "https://ubuntu.com/security/CVE-2026-5946",
                        "cve_description": "Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-5947",
                        "url": "https://ubuntu.com/security/CVE-2026-5947",
                        "cve_description": "Undefined behavior may result due to a race condition leading to a use-after-free violation.  If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature.  If, during that validation, the \"recursive-clients\" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-5950",
                        "url": "https://ubuntu.com/security/CVE-2026-5950",
                        "cve_description": "An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-20 13:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2126464
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-10723",
                                "url": "https://ubuntu.com/security/CVE-2026-10723",
                                "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-10822",
                                "url": "https://ubuntu.com/security/CVE-2026-10822",
                                "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.  BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11331",
                                "url": "https://ubuntu.com/security/CVE-2026-11331",
                                "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11605",
                                "url": "https://ubuntu.com/security/CVE-2026-11605",
                                "cve_description": "The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11622",
                                "url": "https://ubuntu.com/security/CVE-2026-11622",
                                "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-11721",
                                "url": "https://ubuntu.com/security/CVE-2026-11721",
                                "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-12617",
                                "url": "https://ubuntu.com/security/CVE-2026-12617",
                                "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-13321",
                                "url": "https://ubuntu.com/security/CVE-2026-13321",
                                "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-22 15:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Incorrect acceptance of NSEC3 records",
                            "    - debian/patches/CVE-2026-10723-1.patch: Check NSEC3 signer matches the",
                            "      owning zone in lib/dns/dnssec.c, lib/isc/result.c.",
                            "    - debian/patches/CVE-2026-10723-2.patch: Reproducer for #5874 NSEC3",
                            "      impersonation in bin/tests/system/repro_5874_nsec3_parent/ans1/ans.py,",
                            "      bin/tests/system/repro_5874_nsec3_parent/ns2/named.conf.j2,",
                            "      bin/tests/system/repro_5874_nsec3_parent/server.py,",
                            "      bin/tests/system/repro_5874_nsec3_parent/tests_repro_5874_nsec3_parent.py.",
                            "    - debian/patches/CVE-2026-10723-3.patch: Update reproducer #5874 in",
                            "      bin/tests/system/nsec3_impersonation/ans1/ans.py,",
                            "      bin/tests/system/nsec3_impersonation/ns2/named.conf.j2,",
                            "      bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py.",
                            "    - CVE-2026-10723",
                            "  * SECURITY UPDATE: Key Record using PRIVATEDNS algorithm may lead to",
                            "    unexpected exit",
                            "    - debian/patches/CVE-2026-10822-1.patch: Check that dns_name_fromwire",
                            "      honours the active region in tests/dns/name_test.c.",
                            "    - debian/patches/CVE-2026-10822-2.patch: Fix the yaml query zone name code",
                            "      in dnstap-read in bin/tools/dnstap-read.c.",
                            "    - debian/patches/CVE-2026-10822-3.patch: Fix dns_name_fromwire to honour the",
                            "      active region in lib/dns/name.c.",
                            "    - debian/patches/CVE-2026-10822-4.patch: Make it clearer that decompression",
                            "      is not allowed here in lib/dns/rdata.c.",
                            "    - debian/patches/CVE-2026-10822-5.patch: Check that a short PRIVATEDNS",
                            "      record is rejected in tests/dns/rdata_test.c.",
                            "    - CVE-2026-10822",
                            "  * SECURITY UPDATE: Potential wildcard CNAME RPZ policy bypass",
                            "    - debian/patches/CVE-2026-11331-1.patch: Fix TTL extraction from A/AAAA",
                            "      record in bin/tests/system/rpz/tests.sh.",
                            "    - debian/patches/CVE-2026-11331-2.patch: Check rpz name too long wildcard",
                            "      CNAME expansion handling in bin/tests/system/rpz/ns2/tld2.db,",
                            "      bin/tests/system/rpz/ns4/tld4.db, bin/tests/system/rpz/tests.sh.",
                            "    - debian/patches/CVE-2026-11331-3.patch: Properly handle rpz name to long",
                            "      wildcard expansion in lib/ns/query.c.",
                            "    - CVE-2026-11331",
                            "  * SECURITY UPDATE: Unnecessary validation of DNSSEC signed records",
                            "    - debian/patches/CVE-2026-11605-1.patch: Limit DNSSEC denial proof",
                            "      validation per fetch in lib/dns/validator.c.",
                            "    - CVE-2026-11605",
                            "  * SECURITY UPDATE: Potential memory usage beyond configured limits",
                            "    - debian/patches/CVE-2026-11622.patch: Make the dns_slabheaders in the cache",
                            "      reference counted in bin/tests/system/reclimit/tests.sh,",
                            "      lib/dns/include/dns/rdataslab.h, lib/dns/qpcache.c, lib/dns/qpzone.c,",
                            "      lib/dns/rbt-cachedb.c, lib/dns/rbtdb.c, lib/dns/rbtdb_p.h,",
                            "      lib/dns/rdataslab.c.",
                            "    - CVE-2026-11622",
                            "  * SECURITY UPDATE: Cache poisoning possible with label count discrepancy,",
                            "    RRSIG, and wildcards",
                            "    - debian/patches/CVE-2026-11721-1.patch: Don't sign out of zone records in",
                            "      dnssec-signzone in bin/dnssec/dnssec-signzone.c.",
                            "    - debian/patches/CVE-2026-11721-2.patch: Invalid signed wildcard records",
                            "      were being accepted in lib/dns/dnssec.c, lib/dns/rdata/generic/rrsig_46.c.",
                            "    - debian/patches/CVE-2026-11721-3.patch: Test RRSIG record parsing in",
                            "      tests/dns/rdata_test.c.",
                            "    - CVE-2026-11721",
                            "  * SECURITY UPDATE:Record ordering based unexpected exit with CNAME or DNAME",
                            "    - debian/patches/CVE-2026-12617-1.patch: Do not assert in some CNAME/DNAME",
                            "      queries in lib/dns/resolver.c.",
                            "    - debian/patches/CVE-2026-12617-2.patch: Reproducer for #5946 (assertion in",
                            "      some CNAME/DNAME queries) in",
                            "      bin/tests/system/cname_dname_negcache/ans2/ans.py,",
                            "      bin/tests/system/cname_dname_negcache/ns1/bar.test.db,",
                            "      bin/tests/system/cname_dname_negcache/ns1/named.conf.j2,",
                            "      bin/tests/system/cname_dname_negcache/ns1/root.db,",
                            "      bin/tests/system/cname_dname_negcache/ns1/test.db,",
                            "      bin/tests/system/cname_dname_negcache/ns3/named.conf.j2,",
                            "      bin/tests/system/cname_dname_negcache/tests_cname_dname_negcache.py.",
                            "    - CVE-2026-12617",
                            "  * SECURITY UPDATE: Record ordering based unexpected exit with CNAME or DNAME",
                            "    - debian/patches/CVE-2026-13321-1.patch: Add system test for out-of-zone",
                            "      nsec dnssec bypass in bin/tests/system/dnssec_bypass/ns1/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/ns1/root.db,",
                            "      bin/tests/system/dnssec_bypass/ns1/test.db,",
                            "      bin/tests/system/dnssec_bypass/ns2/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/ns2/victim.db,",
                            "      bin/tests/system/dnssec_bypass/ns3/evil.db,",
                            "      bin/tests/system/dnssec_bypass/ns3/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/ns4/named.conf.j2,",
                            "      bin/tests/system/dnssec_bypass/tests_bypass.py.",
                            "    - debian/patches/CVE-2026-13321-2.patch: Reject out-of-zone NSEC next owner",
                            "      names in lib/dns/dnssec.c, lib/dns/include/dns/dnssec.h.",
                            "    - debian/patches/CVE-2026-13321-3.patch: change",
                            "      dns_nsec_requiredtypespresent to dns_nsec_is_legal in",
                            "      lib/dns/include/dns/nsec.h, lib/dns/nsec.c, lib/dns/resolver.c,",
                            "      lib/ns/query.c.",
                            "    - CVE-2026-13321",
                            ""
                        ],
                        "package": "bind9",
                        "version": "1:9.20.24-1ubuntu0.2",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Wed, 29 Jul 2026 11:42:56 -0400"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-1519",
                                "url": "https://ubuntu.com/security/CVE-2026-1519",
                                "cve_description": "If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3104",
                                "url": "https://ubuntu.com/security/CVE-2026-3104",
                                "cve_description": "A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3119",
                                "url": "https://ubuntu.com/security/CVE-2026-3119",
                                "cve_description": "Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3591",
                                "url": "https://ubuntu.com/security/CVE-2026-3591",
                                "cve_description": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-03-25 14:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3039",
                                "url": "https://ubuntu.com/security/CVE-2026-3039",
                                "cve_description": "BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.  Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3592",
                                "url": "https://ubuntu.com/security/CVE-2026-3592",
                                "cve_description": "BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3593",
                                "url": "https://ubuntu.com/security/CVE-2026-3593",
                                "cve_description": "A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-5946",
                                "url": "https://ubuntu.com/security/CVE-2026-5946",
                                "cve_description": "Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-5947",
                                "url": "https://ubuntu.com/security/CVE-2026-5947",
                                "cve_description": "Undefined behavior may result due to a race condition leading to a use-after-free violation.  If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature.  If, during that validation, the \"recursive-clients\" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-5950",
                                "url": "https://ubuntu.com/security/CVE-2026-5950",
                                "cve_description": "An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-20 13:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * New upstream release 9.20.24 (LP: #2126464)",
                            "    - Updates:",
                            "      + Remove the ineffective TCP fallback after repeated UDP timeouts.",
                            "      + Fall back to TCP on receipt of a UDP response with mismatched query ID.",
                            "      + Limit glue records cached from a referral per nameserver.",
                            "      + Reject a CNAME response to a DS query promptly.",
                            "      + Spread cache cleanup probabilistically to avoid CPU spikes and slow",
                            "        queries when the cache approaches its memory limit.",
                            "      + Record query time for all dnstap responses.",
                            "      + Optimize TCP source port selection on Linux via IP_LOCAL_PORT_RANGE.",
                            "      + Use the zone file's basename as origin in dnssec-signzone and",
                            "        dnssec-verify.",
                            "      + Implement seamless outgoing TCP connection reuse with pipelined queries",
                            "        per connection capped at 256.",
                            "      + Randomize nameserver selection.",
                            "      + Make catalog zone names and member zones' entry names case-insensitive.",
                            "    - Bug fixes:",
                            "      + Remove other RRsets at the same name when caching a CNAME.",
                            "      + Fix nxdomain-redirect combined with dns64.",
                            "      + Fix DNS64 owner-name case after a DNAME restart.",
                            "      + Clear the REDIRECT flag when it isn't needed.",
                            "      + Disable output escaping in bind9.xsl.",
                            "      + Fix crash on badly configured secondary signer missing the file entry.",
                            "      + Fix possible crash on concurrent TKEY DELETE for the same key.",
                            "      + Reject RRSIG records covering meta-types ANY, AXFR, IXFR, MAILA, MAILB.",
                            "      + Fix possible race condition during zone transfers.",
                            "      + Fix named crash when processing SIG records in dynamic updates.",
                            "      + Fix zone verification of NSEC3 signed zones.",
                            "      + Prevent a crash when using both dns64 and filter-aaaa.",
                            "      + Fix assertion failure when processing catalog zones with invalid TSIG",
                            "        key name.",
                            "      + Prevent malicious DNSSEC zones from exhausting validator CPU by",
                            "        rejecting DNSKEYs with oversized RSA public exponent.",
                            "      + Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits.",
                            "      + Prevent crafted queries from degrading RRL performance via",
                            "        per-process keyed hash.",
                            "      + Prevent rare named crash when notifies are cancelled.",
                            "      + Stop delv from aborting on malformed query name.",
                            "      + Fix crash when reconfiguring while an NTA is being rechecked.",
                            "      + Fix bug in allow-query/allow-transfer catalog zone custom properties.",
                            "      + Fix memory leak in catalog zones.",
                            "      + Fix suppressed missing-glue check in named-checkzone.",
                            "      + Reject record sets too large to serve in DNS at storage time.",
                            "      + Fix intermittent named crashes during asynchronous zone operations by",
                            "        enforcing loop affinity.",
                            "      + Count temporal DNSSEC validation problems as validation attempts.",
                            "      + Fix possible deadlock in RPZ processing.",
                            "      + Fix crash triggered by rndc modzone on a zone from a configuration",
                            "        file.",
                            "      + Fix processing of empty catalog zone ACLs.",
                            "      + Fix crash triggered by rndc modzone on a zone that already existed in",
                            "        NZF file.",
                            "      + Fix potential resource leak during resolver error handling.",
                            "      + Fix handling of key statements defined inside views.",
                            "      + Fix use-after-free in dns_client_resolve() triggered by a DNAME",
                            "        response.",
                            "      + Fix assertion failure triggered by non-minimal IXFRs.",
                            "      + Fix crash when retrying a NOTIFY over TCP.",
                            "      + Improve fetch loop detection for an in-domain nameserver with expired",
                            "        glue.",
                            "      + Fix dnstap logging of forwarded queries.",
                            "      + Fix stale answer being served on multiple upstream failures when",
                            "        following CNAME chains.",
                            "      + Fail DNSKEY validation when supported but invalid DS is found..",
                            "      + Fix stack memory corruption when importing invalid SKR file.",
                            "      + Return FORMERR for queries with EDNS Client Subnet FAMILY field set to",
                            "        0.",
                            "      + Fix inbound IXFR performance regression where very large IXFR",
                            "        transfers were much slower than in 9.18.",
                            "      + Fix implementation of BRID and HHIT record types.",
                            "      + Fix implementation of DSYNC record type.",
                            "      + Fix response policy and catalog zones to work with INCLUDE directive.",
                            "    - Remove CVE patches fixed upstream",
                            "      + CVE-2026-1519-*.patch",
                            "      + CVE-2026-3104-*.patch",
                            "      + CVE-2026-3119-*.patch",
                            "      + CVE-2026-3591-*.patch",
                            "      [Fixed in 9.20.21]",
                            "      + CVE-2026-3039-*.patch",
                            "      + CVE-2026-3592-*.patch",
                            "      + CVE-2026-3593-*.patch",
                            "      + CVE-2026-5946-*.patch",
                            "      + CVE-2026-5947.patch",
                            "      + CVE-2026-5950-*.patch",
                            "      [Fixed in 9.20.23]",
                            ""
                        ],
                        "package": "bind9",
                        "version": "1:9.20.24-1ubuntu0.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2126464
                        ],
                        "author": "Lena Voytek <lena.voytek@canonical.com>",
                        "date": "Mon, 13 Jul 2026 14:38:03 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "bpftool",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.7.0+7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.7.0+7.0.0-30.30"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-64531",
                        "url": "https://ubuntu.com/security/CVE-2026-64531",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-27 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-46331",
                        "url": "https://ubuntu.com/security/CVE-2026-46331",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-16 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53212",
                        "url": "https://ubuntu.com/security/CVE-2026-53212",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53359",
                        "url": "https://ubuntu.com/security/CVE-2026-53359",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-04 12:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53131",
                        "url": "https://ubuntu.com/security/CVE-2026-53131",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53151",
                        "url": "https://ubuntu.com/security/CVE-2026-53151",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53175",
                        "url": "https://ubuntu.com/security/CVE-2026-53175",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53176",
                        "url": "https://ubuntu.com/security/CVE-2026-53176",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53186",
                        "url": "https://ubuntu.com/security/CVE-2026-53186",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53215",
                        "url": "https://ubuntu.com/security/CVE-2026-53215",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53216",
                        "url": "https://ubuntu.com/security/CVE-2026-53216",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53221",
                        "url": "https://ubuntu.com/security/CVE-2026-53221",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53224",
                        "url": "https://ubuntu.com/security/CVE-2026-53224",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53225",
                        "url": "https://ubuntu.com/security/CVE-2026-53225",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                        "cve_priority": "negligible",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53228",
                        "url": "https://ubuntu.com/security/CVE-2026-53228",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-52924",
                        "url": "https://ubuntu.com/security/CVE-2026-52924",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-24 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53246",
                        "url": "https://ubuntu.com/security/CVE-2026-53246",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53247",
                        "url": "https://ubuntu.com/security/CVE-2026-53247",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53260",
                        "url": "https://ubuntu.com/security/CVE-2026-53260",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2162185,
                    2160781,
                    1786013,
                    2158267
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-64531",
                                "url": "https://ubuntu.com/security/CVE-2026-64531",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-27 08:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)",
                            "",
                            "  * CVE-2026-64531",
                            "    - net: openvswitch: reject oversized nested action attrs",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162185
                        ],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:29 +0200"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-46331",
                                "url": "https://ubuntu.com/security/CVE-2026-46331",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-16 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53212",
                                "url": "https://ubuntu.com/security/CVE-2026-53212",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53359",
                                "url": "https://ubuntu.com/security/CVE-2026-53359",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-04 12:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53131",
                                "url": "https://ubuntu.com/security/CVE-2026-53131",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53151",
                                "url": "https://ubuntu.com/security/CVE-2026-53151",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53175",
                                "url": "https://ubuntu.com/security/CVE-2026-53175",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53176",
                                "url": "https://ubuntu.com/security/CVE-2026-53176",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53186",
                                "url": "https://ubuntu.com/security/CVE-2026-53186",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53215",
                                "url": "https://ubuntu.com/security/CVE-2026-53215",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53216",
                                "url": "https://ubuntu.com/security/CVE-2026-53216",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53221",
                                "url": "https://ubuntu.com/security/CVE-2026-53221",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53224",
                                "url": "https://ubuntu.com/security/CVE-2026-53224",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53225",
                                "url": "https://ubuntu.com/security/CVE-2026-53225",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                                "cve_priority": "negligible",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53228",
                                "url": "https://ubuntu.com/security/CVE-2026-53228",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-52924",
                                "url": "https://ubuntu.com/security/CVE-2026-52924",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-24 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53246",
                                "url": "https://ubuntu.com/security/CVE-2026-53246",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53247",
                                "url": "https://ubuntu.com/security/CVE-2026-53247",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53260",
                                "url": "https://ubuntu.com/security/CVE-2026-53260",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)",
                            "",
                            "  * Packaging resync (LP: #1786013)",
                            "    - [Packaging] update annotations scripts",
                            "",
                            "  * CVE-2026-46331",
                            "    - net/sched: fix pedit partial COW leading to page cache corruption",
                            "",
                            "  * CVE-2026-53212",
                            "    - netfilter: nft_tunnel: fix use-after-free on object destroy",
                            "",
                            "  * CVE-2026-53359",
                            "    - KVM: x86: Fix shadow paging use-after-free due to unexpected role",
                            "",
                            "  * CVE-2026-53131",
                            "    - netfilter: require Ethernet MAC header before using eth_hdr()",
                            "",
                            "  * CVE-2026-53151",
                            "    - rxrpc: Fix the ACK parser to extract the SACK table for parsing",
                            "",
                            "  * CVE-2026-53175",
                            "    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
                            "",
                            "  * CVE-2026-53176",
                            "    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
                            "",
                            "  * CVE-2026-53186",
                            "    - RDMA/srp: bound SRP_RSP sense copy by the received length",
                            "",
                            "  * CVE-2026-53215",
                            "    - net: mvpp2: refill RX buffers before XDP or skb use",
                            "",
                            "  * CVE-2026-53216",
                            "    - net: mvpp2: limit XDP frame size to the RX buffer",
                            "",
                            "  * CVE-2026-53221",
                            "    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
                            "",
                            "  * CVE-2026-53224",
                            "    - sctp: validate embedded INIT chunk and address list lengths in cookie",
                            "",
                            "  * CVE-2026-53225",
                            "    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
                            "",
                            "  * CVE-2026-53228",
                            "    - ipv6: sit: reload inner IPv6 header after GSO offloads",
                            "",
                            "  * CVE-2026-52924",
                            "    - sctp: purge outqueue on stale COOKIE-ECHO handling",
                            "",
                            "  * CVE-2026-53246",
                            "    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
                            "",
                            "  * CVE-2026-53247",
                            "    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
                            "",
                            "  * CVE-2026-53260",
                            "    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
                            "",
                            "  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)",
                            "    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-29.29",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2160781,
                            1786013,
                            2158267
                        ],
                        "author": "Manuel Diewald <manuel.diewald@canonical.com>",
                        "date": "Fri, 17 Jul 2026 18:57:53 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "cloud-init",
                "from_version": {
                    "source_package_name": "cloud-init",
                    "source_package_version": "26.1-0ubuntu2",
                    "version": "26.1-0ubuntu2"
                },
                "to_version": {
                    "source_package_name": "cloud-init",
                    "source_package_version": "26.1-0ubuntu3~26.04.1",
                    "version": "26.1-0ubuntu3~26.04.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2161665
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * cherry-pick bd85f29d: fix(oracle): detect iSCSI root via iBFT for",
                            "    dracut images (LP: #2161665)",
                            ""
                        ],
                        "package": "cloud-init",
                        "version": "26.1-0ubuntu3~26.04.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2161665
                        ],
                        "author": "Chad Smith <chad.smith@canonical.com>",
                        "date": "Thu, 23 Jul 2026 10:34:30 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "cloud-init-base",
                "from_version": {
                    "source_package_name": "cloud-init",
                    "source_package_version": "26.1-0ubuntu2",
                    "version": "26.1-0ubuntu2"
                },
                "to_version": {
                    "source_package_name": "cloud-init",
                    "source_package_version": "26.1-0ubuntu3~26.04.1",
                    "version": "26.1-0ubuntu3~26.04.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2161665
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * cherry-pick bd85f29d: fix(oracle): detect iSCSI root via iBFT for",
                            "    dracut images (LP: #2161665)",
                            ""
                        ],
                        "package": "cloud-init",
                        "version": "26.1-0ubuntu3~26.04.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2161665
                        ],
                        "author": "Chad Smith <chad.smith@canonical.com>",
                        "date": "Thu, 23 Jul 2026 10:34:30 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "console-setup",
                "from_version": {
                    "source_package_name": "console-setup",
                    "source_package_version": "1.237ubuntu3",
                    "version": "1.237ubuntu3"
                },
                "to_version": {
                    "source_package_name": "console-setup",
                    "source_package_version": "1.237ubuntu3.1",
                    "version": "1.237ubuntu3.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2152901
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * No change rebuild against keymapper 0.6.4ubuntu0~26.04 (LP: #2152901).",
                            "    This should produce the expected pc105.tree file that core24-based",
                            "    Subiquity consumes at build time.",
                            ""
                        ],
                        "package": "console-setup",
                        "version": "1.237ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2152901
                        ],
                        "author": "Olivier Gayot <olivier.gayot@canonical.com>",
                        "date": "Thu, 25 Jun 2026 11:51:10 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "console-setup-linux",
                "from_version": {
                    "source_package_name": "console-setup",
                    "source_package_version": "1.237ubuntu3",
                    "version": "1.237ubuntu3"
                },
                "to_version": {
                    "source_package_name": "console-setup",
                    "source_package_version": "1.237ubuntu3.1",
                    "version": "1.237ubuntu3.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2152901
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * No change rebuild against keymapper 0.6.4ubuntu0~26.04 (LP: #2152901).",
                            "    This should produce the expected pc105.tree file that core24-based",
                            "    Subiquity consumes at build time.",
                            ""
                        ],
                        "package": "console-setup",
                        "version": "1.237ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2152901
                        ],
                        "author": "Olivier Gayot <olivier.gayot@canonical.com>",
                        "date": "Thu, 25 Jun 2026 11:51:10 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "curl",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.18.0-1ubuntu2.3",
                    "version": "8.18.0-1ubuntu2.3"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.18.0-1ubuntu2.4",
                    "version": "8.18.0-1ubuntu2.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-11856",
                        "url": "https://ubuntu.com/security/CVE-2026-11856",
                        "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`, to `hostB`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-11856",
                                "url": "https://ubuntu.com/security/CVE-2026-11856",
                                "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`, to `hostB`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Authentication Bypass by Capture-replay",
                            "    - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential",
                            "      change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and",
                            "      lib/vauth/digest_sspi.c.",
                            "    - CVE-2026-11856",
                            ""
                        ],
                        "package": "curl",
                        "version": "8.18.0-1ubuntu2.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 17:08:49 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "flash-kernel",
                "from_version": {
                    "source_package_name": "flash-kernel",
                    "source_package_version": "3.110ubuntu2.1",
                    "version": "3.110ubuntu2.1"
                },
                "to_version": {
                    "source_package_name": "flash-kernel",
                    "source_package_version": "3.110ubuntu2.3",
                    "version": "3.110ubuntu2.3"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2158717,
                    2151216
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * db/all.db: Add entry for SpacemiT K3 CoM260 IFX (LP: #2158717)",
                            ""
                        ],
                        "package": "flash-kernel",
                        "version": "3.110ubuntu2.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158717
                        ],
                        "author": "Valentin Haudiquet <valentin.haudiquet@canonical.com>",
                        "date": "Thu, 02 Jul 2026 13:25:22 +0200"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/control: Declare breaks on raspi meta-packages from versions prior to",
                            "    resolute (LP: #2151216)",
                            ""
                        ],
                        "package": "flash-kernel",
                        "version": "3.110ubuntu2.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2151216
                        ],
                        "author": "Dave Jones <dave.jones@canonical.com>",
                        "date": "Tue, 09 Jun 2026 16:16:11 +0100"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "gir1.2-packagekitglib-1.0",
                "from_version": {
                    "source_package_name": "packagekit",
                    "source_package_version": "1.3.4-3ubuntu1.1",
                    "version": "1.3.4-3ubuntu1.1"
                },
                "to_version": {
                    "source_package_name": "packagekit",
                    "source_package_version": "1.3.4-3ubuntu1.2",
                    "version": "1.3.4-3ubuntu1.2"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2148469
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Hector Cao ]",
                            "  * d/p/lp2148469-apt-use-solve-3.0.patch: use apt solver 3.0",
                            "    (LP: #2148469)",
                            "",
                            "  [ Alessandro Astone ]",
                            "  * d/p/pkgcli-Skip-blocked-updates-in-full-upgrade-too.patch.",
                            "    Fix `pkgcli upgrade` command after switching to apt solver 3.0, which would",
                            "    fail if some update was held back.",
                            ""
                        ],
                        "package": "packagekit",
                        "version": "1.3.4-3ubuntu1.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148469
                        ],
                        "author": "Alessandro Astone <alessandro.astone@canonical.com>",
                        "date": "Mon, 20 Jul 2026 13:28:13 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "grub-efi-arm",
                "from_version": {
                    "source_package_name": "grub2",
                    "source_package_version": "2.14-2ubuntu2",
                    "version": "2.14-2ubuntu2"
                },
                "to_version": {
                    "source_package_name": "grub2",
                    "source_package_version": "2.14-2ubuntu2.1",
                    "version": "2.14-2ubuntu2.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2156423
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)",
                            ""
                        ],
                        "package": "grub2",
                        "version": "2.14-2ubuntu2.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2156423
                        ],
                        "author": "Mate Kukri <mate.kukri@canonical.com>",
                        "date": "Wed, 01 Jul 2026 10:30:38 +0100"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "grub-efi-arm-bin",
                "from_version": {
                    "source_package_name": "grub2",
                    "source_package_version": "2.14-2ubuntu2",
                    "version": "2.14-2ubuntu2"
                },
                "to_version": {
                    "source_package_name": "grub2",
                    "source_package_version": "2.14-2ubuntu2.1",
                    "version": "2.14-2ubuntu2.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2156423
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)",
                            ""
                        ],
                        "package": "grub2",
                        "version": "2.14-2ubuntu2.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2156423
                        ],
                        "author": "Mate Kukri <mate.kukri@canonical.com>",
                        "date": "Wed, 01 Jul 2026 10:30:38 +0100"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "grub-efi-arm-unsigned",
                "from_version": {
                    "source_package_name": "grub2",
                    "source_package_version": "2.14-2ubuntu2",
                    "version": "2.14-2ubuntu2"
                },
                "to_version": {
                    "source_package_name": "grub2",
                    "source_package_version": "2.14-2ubuntu2.1",
                    "version": "2.14-2ubuntu2.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2156423
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)",
                            ""
                        ],
                        "package": "grub2",
                        "version": "2.14-2ubuntu2.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2156423
                        ],
                        "author": "Mate Kukri <mate.kukri@canonical.com>",
                        "date": "Wed, 01 Jul 2026 10:30:38 +0100"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "grub2-common",
                "from_version": {
                    "source_package_name": "grub2",
                    "source_package_version": "2.14-2ubuntu2",
                    "version": "2.14-2ubuntu2"
                },
                "to_version": {
                    "source_package_name": "grub2",
                    "source_package_version": "2.14-2ubuntu2.1",
                    "version": "2.14-2ubuntu2.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2156423
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)",
                            ""
                        ],
                        "package": "grub2",
                        "version": "2.14-2ubuntu2.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2156423
                        ],
                        "author": "Mate Kukri <mate.kukri@canonical.com>",
                        "date": "Wed, 01 Jul 2026 10:30:38 +0100"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "keyboard-configuration",
                "from_version": {
                    "source_package_name": "console-setup",
                    "source_package_version": "1.237ubuntu3",
                    "version": "1.237ubuntu3"
                },
                "to_version": {
                    "source_package_name": "console-setup",
                    "source_package_version": "1.237ubuntu3.1",
                    "version": "1.237ubuntu3.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2152901
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * No change rebuild against keymapper 0.6.4ubuntu0~26.04 (LP: #2152901).",
                            "    This should produce the expected pc105.tree file that core24-based",
                            "    Subiquity consumes at build time.",
                            ""
                        ],
                        "package": "console-setup",
                        "version": "1.237ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2152901
                        ],
                        "author": "Olivier Gayot <olivier.gayot@canonical.com>",
                        "date": "Thu, 25 Jun 2026 11:51:10 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libapparmor1:armhf",
                "from_version": {
                    "source_package_name": "apparmor",
                    "source_package_version": "5.0.0~beta1-0ubuntu7",
                    "version": "5.0.0~beta1-0ubuntu7"
                },
                "to_version": {
                    "source_package_name": "apparmor",
                    "source_package_version": "5.0.2-0ubuntu1~26.04.1",
                    "version": "5.0.2-0ubuntu1~26.04.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2161458,
                    2158941,
                    2158939,
                    2157575,
                    2152079
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * New upstream release (SRU backport). (LP: #2161458)",
                            "  * Upstream release contains fixes for:",
                            "    - uucore locales reads (LP: #2158941)",
                            "    - lsusb uevent file reads (LP: #2158939)",
                            "    - alsamixer asound config reads (LP: #2157575)",
                            "  * d/apparmor.install: add the new glycin.* profiles",
                            "  * d/libapparmor1.symbols: add the new library symbols",
                            "  * d/rules: add profiles check to testing step",
                            "  * d/watch:",
                            "    - Update regex to handle -rc version numbers",
                            "    - Update to version 5 of the format",
                            "  * Refresh patches to apply to upstream release:",
                            "    - d/p/u/profiles-grant-access-to-systemd-resolved.patch",
                            "    - d/p/u/aa-notify-fallback-to-ev-comm-when-ev-execpath.patch",
                            "  * Update patches to apply to upstream release:",
                            "    - d/p/u/samba-systemd-interaction.patch",
                            "    - d/p/u/profiles_disable_curl.patch",
                            "    - d/p/u/profiles_add_more_consoles_workaround.patch",
                            "    - d/p/u/profiles-use-coreutils-tunable.patch",
                            "    - d/p/u/0001-parser-add-more-reserved-mediation-classes.patch",
                            "    - d/p/u/0007-Set-parser-network.h-ip_conds-ptrs-to-null-in-its-fr.patch",
                            "  * Drop patches that were applied upstream:",
                            "    - d/p/u/libapparmor-move-aa_get_lsm_iface-decl-in-libapparmor.patch",
                            "    - d/p/u/0001-parser-set-umask-before-creating-temp-file.patch",
                            "    - d/p/u/0002-parser-restrict-umask-to-allow-only-user-permissions.patch",
                            "    - d/p/u/libapparmor-add-test-for-libapparmor-features-prefix.patch",
                            "    - d/p/u/transmission-common-fixes-for-lp-2137395.patch",
                            "    - d/p/u/unix-chkpwd-add-disconnected-run-paths.patch",
                            "    - d/p/u/profiles-add-extensions-to-allowed-ghostscript.patch",
                            "    - d/p/u/profiles-expand-the-allowed-directories-for-ghostscript.patch",
                            "    - d/p/u/profiles-add-sys-kernel-mm-transparent_hugepage-enable.patch",
                            "    - d/p/u/0006-parser-name-ns_domain-and-network_v9-classes.patch",
                            "    - d/p/u/0011-utils-add-support-for-iface-an-label-in-network-rule.patch",
                            "    - d/p/u/0013-parser-fix-FTBFS-due-to-missing-merge-edit.patch",
                            "    - d/p/u/0014-tests-check-if-skb-mediation-is-enabled.patch",
                            "    - d/p/u/snap-browser-add-missing-perms-when-opening-from-link.patch",
                            "    - d/p/u/lsusb-allow-reading-etc-udev-hwdb-bin.patch",
                            "    - d/p/u/profiles-grant-unix-domain-socket-access-to-sanitize.patch",
                            "    - d/p/u/0002-parser-refactor-compressed-policy-cache.patch",
                            "    - d/p/u/0003-parser-handle-compressed-cache-on-kernels-without-de.patch",
                            "    - d/p/u/0004-regression-fix-the-e2e-test-for-compressed-caches.patch",
                            "  * Drop patches that were superseded upstream:",
                            "    - d/p/u/0002-parser-convert-conditionals-operators-to-an-enum.patch",
                            "    - d/p/u/0003-parser-add-override-assign-to-cond-list-elements.patch",
                            "    - d/p/u/0004-parser-support-network-interface-conditional.patch",
                            "    - d/p/u/0005-tests-add-network-interface-tests.patch",
                            "    - d/p/u/0008-parser-move-to-encode-an-alternation-of-a-null-trans.patch",
                            "    - d/p/u/0009-parser-disable-ability-to-specify-interface-on-peer-.patch",
                            "    - d/p/u/0010-parser-fix-iface-perms-to-work-when-v9-and-v9_skb-ar.patch",
                            "    - d/p/u/0012-parser-fix-label-match-for-default-label-values.patch",
                            "    - d/p/u/0001-parser-fix-rewriting-of-cache-after-zstd-recompressi.patch",
                            "  * Add patches to fix FTBFS (profile test enabling):",
                            "    - d/p/u/profiles-allow-more-attach-disconnected.patch",
                            "  * Update patches to fix FTBFS (profile test enabling):",
                            "    - d/p/u/openvpn_mr_1263.patch",
                            "    - d/p/u/irssi_mr_1332.patch",
                            "    - d/p/u/os_prober_mr_1569.patch",
                            "    - d/p/u/profiles_disable_free.patch",
                            "    - d/p/u/profiles_disable_curl.patch",
                            "    - d/p/u/profiles-tunables-add-coreutils-var.patch",
                            "    - d/p/u/profiles-use-coreutils-tunable.patch",
                            "    - d/p/u/profiles-pull-openvpn-profile.patch",
                            "  * Add patch to fix transmission-gtk file chooser (LP: #2152079):",
                            "    - d/p/u/profiles-add-file-chooser-rules-to-abstractions-trans.patch",
                            ""
                        ],
                        "package": "apparmor",
                        "version": "5.0.2-0ubuntu1~26.04.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2161458,
                            2158941,
                            2158939,
                            2157575,
                            2152079
                        ],
                        "author": "Ryan Lee <ryan.lee@canonical.com>",
                        "date": "Mon, 13 Jul 2026 10:43:46 -0700"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libcurl3t64-gnutls:armhf",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.18.0-1ubuntu2.3",
                    "version": "8.18.0-1ubuntu2.3"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.18.0-1ubuntu2.4",
                    "version": "8.18.0-1ubuntu2.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-11856",
                        "url": "https://ubuntu.com/security/CVE-2026-11856",
                        "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`, to `hostB`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-11856",
                                "url": "https://ubuntu.com/security/CVE-2026-11856",
                                "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`, to `hostB`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Authentication Bypass by Capture-replay",
                            "    - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential",
                            "      change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and",
                            "      lib/vauth/digest_sspi.c.",
                            "    - CVE-2026-11856",
                            ""
                        ],
                        "package": "curl",
                        "version": "8.18.0-1ubuntu2.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 17:08:49 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libcurl4t64:armhf",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.18.0-1ubuntu2.3",
                    "version": "8.18.0-1ubuntu2.3"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.18.0-1ubuntu2.4",
                    "version": "8.18.0-1ubuntu2.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-11856",
                        "url": "https://ubuntu.com/security/CVE-2026-11856",
                        "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`, to `hostB`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-11856",
                                "url": "https://ubuntu.com/security/CVE-2026-11856",
                                "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`, to `hostB`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Authentication Bypass by Capture-replay",
                            "    - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential",
                            "      change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and",
                            "      lib/vauth/digest_sspi.c.",
                            "    - CVE-2026-11856",
                            ""
                        ],
                        "package": "curl",
                        "version": "8.18.0-1ubuntu2.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 17:08:49 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libnss-systemd:armhf",
                "from_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3",
                    "version": "259.5-0ubuntu3"
                },
                "to_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3.4",
                    "version": "259.5-0ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-16742",
                        "url": "https://ubuntu.com/security/CVE-2026-16742",
                        "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15059",
                        "url": "https://ubuntu.com/security/CVE-2026-15059",
                        "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15060",
                        "url": "https://ubuntu.com/security/CVE-2026-15060",
                        "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158686,
                    2157342,
                    2157344,
                    2148619,
                    2150773,
                    2155132
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-16742",
                                "url": "https://ubuntu.com/security/CVE-2026-16742",
                                "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15059",
                                "url": "https://ubuntu.com/security/CVE-2026-15059",
                                "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15060",
                                "url": "https://ubuntu.com/security/CVE-2026-15060",
                                "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: systemd-homed: local privilege escalation via missing",
                            "    home-record signature verification on the authenticate path",
                            "    - homed-fix-verification-of-local-identity-file.patch",
                            "    - homed-verify-privileged-worker-changes.patch",
                            "    - CVE-2026-16742",
                            "  * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary",
                            "    processes",
                            "    - CVE-2026-15059.patch",
                            "    - CVE-2026-15059",
                            "  * SECURITY UPDATE: systemd-machined: unprivileged users can terminate",
                            "    arbitrary processes",
                            "    - CVE-2026-15060.patch",
                            "    - CVE-2026-15060",
                            "  * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various",
                            "    components via Varlink",
                            "    - GHSA-5rm9-cc37-35gq.patch",
                            "    - GHSA-5rm9-cc37-35gq",
                            "  * SECURITY UPDATE: udev: local root execution via malicious iscsi devices",
                            "    and unsanitized kernel output",
                            "    - GHSA-m8q3-73v4-wvg7.patch",
                            "    - GHSA-m8q3-73v4-wvg7",
                            "  * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure",
                            "    via systemd-machined",
                            "    - GHSA-2p9f-rcmv-x36h.patch",
                            "    - GHSA-2p9f-rcmv-x36h",
                            "  * SECURITY UPDATE: crash triggered by unprivileged users in various",
                            "    components via D-Bus/Varlink",
                            "    - core-limit-the-number-of-units-that-can-be-requested-over.patch",
                            "    - dbus-limit-the-number-of-env-variables-to-something-reaso.patch",
                            "    - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch",
                            "    - dns-question-limit-the-number-of-questions-per-query.patch",
                            "    - resolve-enforce-the-search-domain-limit-earlier.patch",
                            "    - resolve-limit-the-number-NTAs-to-something-sensible.patch",
                            "    - sd-bus-store-the-strv-size-when-extending-it.patch",
                            "    - sd-json-limit-the-number-of-env-variables-to-something-re.patch",
                            "    - sd-json-user-record-store-the-strv-size-when-extending-it.patch",
                            "    - GHSA-3jgj-3phh-hx5j",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Mon, 27 Jul 2026 16:44:02 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.",
                            "    Otherwise, the debhelper-generated systemd-tmpfiles call will include",
                            "    var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when",
                            "    the systemd package is upgraded. (LP: #2158686)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158686
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Wed, 22 Jul 2026 13:07:19 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)",
                            "  * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts",
                            "    (LP: #2157344)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157342,
                            2157344
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Thu, 18 Jun 2026 10:27:05 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)",
                            "    - units: order networkd resolve hook After=network-pre.target",
                            "    - units: drop Before=sockets.target from networkd resolve hook",
                            "  * core: Open netfilter socket only when needed (LP: #2150773)",
                            "  * mkosi: trim verity.sig json files to remove NUL padding before passing to jq",
                            "    (LP: #2155132)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148619,
                            2150773,
                            2155132
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Tue, 09 Jun 2026 08:59:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libpackagekit-glib2-18:armhf",
                "from_version": {
                    "source_package_name": "packagekit",
                    "source_package_version": "1.3.4-3ubuntu1.1",
                    "version": "1.3.4-3ubuntu1.1"
                },
                "to_version": {
                    "source_package_name": "packagekit",
                    "source_package_version": "1.3.4-3ubuntu1.2",
                    "version": "1.3.4-3ubuntu1.2"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2148469
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Hector Cao ]",
                            "  * d/p/lp2148469-apt-use-solve-3.0.patch: use apt solver 3.0",
                            "    (LP: #2148469)",
                            "",
                            "  [ Alessandro Astone ]",
                            "  * d/p/pkgcli-Skip-blocked-updates-in-full-upgrade-too.patch.",
                            "    Fix `pkgcli upgrade` command after switching to apt solver 3.0, which would",
                            "    fail if some update was held back.",
                            ""
                        ],
                        "package": "packagekit",
                        "version": "1.3.4-3ubuntu1.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148469
                        ],
                        "author": "Alessandro Astone <alessandro.astone@canonical.com>",
                        "date": "Mon, 20 Jul 2026 13:28:13 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libpam-systemd:armhf",
                "from_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3",
                    "version": "259.5-0ubuntu3"
                },
                "to_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3.4",
                    "version": "259.5-0ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-16742",
                        "url": "https://ubuntu.com/security/CVE-2026-16742",
                        "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15059",
                        "url": "https://ubuntu.com/security/CVE-2026-15059",
                        "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15060",
                        "url": "https://ubuntu.com/security/CVE-2026-15060",
                        "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158686,
                    2157342,
                    2157344,
                    2148619,
                    2150773,
                    2155132
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-16742",
                                "url": "https://ubuntu.com/security/CVE-2026-16742",
                                "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15059",
                                "url": "https://ubuntu.com/security/CVE-2026-15059",
                                "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15060",
                                "url": "https://ubuntu.com/security/CVE-2026-15060",
                                "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: systemd-homed: local privilege escalation via missing",
                            "    home-record signature verification on the authenticate path",
                            "    - homed-fix-verification-of-local-identity-file.patch",
                            "    - homed-verify-privileged-worker-changes.patch",
                            "    - CVE-2026-16742",
                            "  * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary",
                            "    processes",
                            "    - CVE-2026-15059.patch",
                            "    - CVE-2026-15059",
                            "  * SECURITY UPDATE: systemd-machined: unprivileged users can terminate",
                            "    arbitrary processes",
                            "    - CVE-2026-15060.patch",
                            "    - CVE-2026-15060",
                            "  * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various",
                            "    components via Varlink",
                            "    - GHSA-5rm9-cc37-35gq.patch",
                            "    - GHSA-5rm9-cc37-35gq",
                            "  * SECURITY UPDATE: udev: local root execution via malicious iscsi devices",
                            "    and unsanitized kernel output",
                            "    - GHSA-m8q3-73v4-wvg7.patch",
                            "    - GHSA-m8q3-73v4-wvg7",
                            "  * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure",
                            "    via systemd-machined",
                            "    - GHSA-2p9f-rcmv-x36h.patch",
                            "    - GHSA-2p9f-rcmv-x36h",
                            "  * SECURITY UPDATE: crash triggered by unprivileged users in various",
                            "    components via D-Bus/Varlink",
                            "    - core-limit-the-number-of-units-that-can-be-requested-over.patch",
                            "    - dbus-limit-the-number-of-env-variables-to-something-reaso.patch",
                            "    - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch",
                            "    - dns-question-limit-the-number-of-questions-per-query.patch",
                            "    - resolve-enforce-the-search-domain-limit-earlier.patch",
                            "    - resolve-limit-the-number-NTAs-to-something-sensible.patch",
                            "    - sd-bus-store-the-strv-size-when-extending-it.patch",
                            "    - sd-json-limit-the-number-of-env-variables-to-something-re.patch",
                            "    - sd-json-user-record-store-the-strv-size-when-extending-it.patch",
                            "    - GHSA-3jgj-3phh-hx5j",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Mon, 27 Jul 2026 16:44:02 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.",
                            "    Otherwise, the debhelper-generated systemd-tmpfiles call will include",
                            "    var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when",
                            "    the systemd package is upgraded. (LP: #2158686)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158686
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Wed, 22 Jul 2026 13:07:19 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)",
                            "  * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts",
                            "    (LP: #2157344)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157342,
                            2157344
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Thu, 18 Jun 2026 10:27:05 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)",
                            "    - units: order networkd resolve hook After=network-pre.target",
                            "    - units: drop Before=sockets.target from networkd resolve hook",
                            "  * core: Open netfilter socket only when needed (LP: #2150773)",
                            "  * mkosi: trim verity.sig json files to remove NUL padding before passing to jq",
                            "    (LP: #2155132)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148619,
                            2150773,
                            2155132
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Tue, 09 Jun 2026 08:59:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libsystemd-shared:armhf",
                "from_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3",
                    "version": "259.5-0ubuntu3"
                },
                "to_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3.4",
                    "version": "259.5-0ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-16742",
                        "url": "https://ubuntu.com/security/CVE-2026-16742",
                        "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15059",
                        "url": "https://ubuntu.com/security/CVE-2026-15059",
                        "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15060",
                        "url": "https://ubuntu.com/security/CVE-2026-15060",
                        "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158686,
                    2157342,
                    2157344,
                    2148619,
                    2150773,
                    2155132
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-16742",
                                "url": "https://ubuntu.com/security/CVE-2026-16742",
                                "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15059",
                                "url": "https://ubuntu.com/security/CVE-2026-15059",
                                "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15060",
                                "url": "https://ubuntu.com/security/CVE-2026-15060",
                                "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: systemd-homed: local privilege escalation via missing",
                            "    home-record signature verification on the authenticate path",
                            "    - homed-fix-verification-of-local-identity-file.patch",
                            "    - homed-verify-privileged-worker-changes.patch",
                            "    - CVE-2026-16742",
                            "  * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary",
                            "    processes",
                            "    - CVE-2026-15059.patch",
                            "    - CVE-2026-15059",
                            "  * SECURITY UPDATE: systemd-machined: unprivileged users can terminate",
                            "    arbitrary processes",
                            "    - CVE-2026-15060.patch",
                            "    - CVE-2026-15060",
                            "  * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various",
                            "    components via Varlink",
                            "    - GHSA-5rm9-cc37-35gq.patch",
                            "    - GHSA-5rm9-cc37-35gq",
                            "  * SECURITY UPDATE: udev: local root execution via malicious iscsi devices",
                            "    and unsanitized kernel output",
                            "    - GHSA-m8q3-73v4-wvg7.patch",
                            "    - GHSA-m8q3-73v4-wvg7",
                            "  * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure",
                            "    via systemd-machined",
                            "    - GHSA-2p9f-rcmv-x36h.patch",
                            "    - GHSA-2p9f-rcmv-x36h",
                            "  * SECURITY UPDATE: crash triggered by unprivileged users in various",
                            "    components via D-Bus/Varlink",
                            "    - core-limit-the-number-of-units-that-can-be-requested-over.patch",
                            "    - dbus-limit-the-number-of-env-variables-to-something-reaso.patch",
                            "    - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch",
                            "    - dns-question-limit-the-number-of-questions-per-query.patch",
                            "    - resolve-enforce-the-search-domain-limit-earlier.patch",
                            "    - resolve-limit-the-number-NTAs-to-something-sensible.patch",
                            "    - sd-bus-store-the-strv-size-when-extending-it.patch",
                            "    - sd-json-limit-the-number-of-env-variables-to-something-re.patch",
                            "    - sd-json-user-record-store-the-strv-size-when-extending-it.patch",
                            "    - GHSA-3jgj-3phh-hx5j",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Mon, 27 Jul 2026 16:44:02 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.",
                            "    Otherwise, the debhelper-generated systemd-tmpfiles call will include",
                            "    var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when",
                            "    the systemd package is upgraded. (LP: #2158686)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158686
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Wed, 22 Jul 2026 13:07:19 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)",
                            "  * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts",
                            "    (LP: #2157344)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157342,
                            2157344
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Thu, 18 Jun 2026 10:27:05 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)",
                            "    - units: order networkd resolve hook After=network-pre.target",
                            "    - units: drop Before=sockets.target from networkd resolve hook",
                            "  * core: Open netfilter socket only when needed (LP: #2150773)",
                            "  * mkosi: trim verity.sig json files to remove NUL padding before passing to jq",
                            "    (LP: #2155132)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148619,
                            2150773,
                            2155132
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Tue, 09 Jun 2026 08:59:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libsystemd0:armhf",
                "from_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3",
                    "version": "259.5-0ubuntu3"
                },
                "to_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3.4",
                    "version": "259.5-0ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-16742",
                        "url": "https://ubuntu.com/security/CVE-2026-16742",
                        "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15059",
                        "url": "https://ubuntu.com/security/CVE-2026-15059",
                        "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15060",
                        "url": "https://ubuntu.com/security/CVE-2026-15060",
                        "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158686,
                    2157342,
                    2157344,
                    2148619,
                    2150773,
                    2155132
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-16742",
                                "url": "https://ubuntu.com/security/CVE-2026-16742",
                                "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15059",
                                "url": "https://ubuntu.com/security/CVE-2026-15059",
                                "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15060",
                                "url": "https://ubuntu.com/security/CVE-2026-15060",
                                "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: systemd-homed: local privilege escalation via missing",
                            "    home-record signature verification on the authenticate path",
                            "    - homed-fix-verification-of-local-identity-file.patch",
                            "    - homed-verify-privileged-worker-changes.patch",
                            "    - CVE-2026-16742",
                            "  * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary",
                            "    processes",
                            "    - CVE-2026-15059.patch",
                            "    - CVE-2026-15059",
                            "  * SECURITY UPDATE: systemd-machined: unprivileged users can terminate",
                            "    arbitrary processes",
                            "    - CVE-2026-15060.patch",
                            "    - CVE-2026-15060",
                            "  * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various",
                            "    components via Varlink",
                            "    - GHSA-5rm9-cc37-35gq.patch",
                            "    - GHSA-5rm9-cc37-35gq",
                            "  * SECURITY UPDATE: udev: local root execution via malicious iscsi devices",
                            "    and unsanitized kernel output",
                            "    - GHSA-m8q3-73v4-wvg7.patch",
                            "    - GHSA-m8q3-73v4-wvg7",
                            "  * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure",
                            "    via systemd-machined",
                            "    - GHSA-2p9f-rcmv-x36h.patch",
                            "    - GHSA-2p9f-rcmv-x36h",
                            "  * SECURITY UPDATE: crash triggered by unprivileged users in various",
                            "    components via D-Bus/Varlink",
                            "    - core-limit-the-number-of-units-that-can-be-requested-over.patch",
                            "    - dbus-limit-the-number-of-env-variables-to-something-reaso.patch",
                            "    - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch",
                            "    - dns-question-limit-the-number-of-questions-per-query.patch",
                            "    - resolve-enforce-the-search-domain-limit-earlier.patch",
                            "    - resolve-limit-the-number-NTAs-to-something-sensible.patch",
                            "    - sd-bus-store-the-strv-size-when-extending-it.patch",
                            "    - sd-json-limit-the-number-of-env-variables-to-something-re.patch",
                            "    - sd-json-user-record-store-the-strv-size-when-extending-it.patch",
                            "    - GHSA-3jgj-3phh-hx5j",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Mon, 27 Jul 2026 16:44:02 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.",
                            "    Otherwise, the debhelper-generated systemd-tmpfiles call will include",
                            "    var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when",
                            "    the systemd package is upgraded. (LP: #2158686)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158686
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Wed, 22 Jul 2026 13:07:19 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)",
                            "  * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts",
                            "    (LP: #2157344)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157342,
                            2157344
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Thu, 18 Jun 2026 10:27:05 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)",
                            "    - units: order networkd resolve hook After=network-pre.target",
                            "    - units: drop Before=sockets.target from networkd resolve hook",
                            "  * core: Open netfilter socket only when needed (LP: #2150773)",
                            "  * mkosi: trim verity.sig json files to remove NUL padding before passing to jq",
                            "    (LP: #2155132)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148619,
                            2150773,
                            2155132
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Tue, 09 Jun 2026 08:59:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libudev1:armhf",
                "from_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3",
                    "version": "259.5-0ubuntu3"
                },
                "to_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3.4",
                    "version": "259.5-0ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-16742",
                        "url": "https://ubuntu.com/security/CVE-2026-16742",
                        "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15059",
                        "url": "https://ubuntu.com/security/CVE-2026-15059",
                        "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15060",
                        "url": "https://ubuntu.com/security/CVE-2026-15060",
                        "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158686,
                    2157342,
                    2157344,
                    2148619,
                    2150773,
                    2155132
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-16742",
                                "url": "https://ubuntu.com/security/CVE-2026-16742",
                                "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15059",
                                "url": "https://ubuntu.com/security/CVE-2026-15059",
                                "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15060",
                                "url": "https://ubuntu.com/security/CVE-2026-15060",
                                "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: systemd-homed: local privilege escalation via missing",
                            "    home-record signature verification on the authenticate path",
                            "    - homed-fix-verification-of-local-identity-file.patch",
                            "    - homed-verify-privileged-worker-changes.patch",
                            "    - CVE-2026-16742",
                            "  * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary",
                            "    processes",
                            "    - CVE-2026-15059.patch",
                            "    - CVE-2026-15059",
                            "  * SECURITY UPDATE: systemd-machined: unprivileged users can terminate",
                            "    arbitrary processes",
                            "    - CVE-2026-15060.patch",
                            "    - CVE-2026-15060",
                            "  * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various",
                            "    components via Varlink",
                            "    - GHSA-5rm9-cc37-35gq.patch",
                            "    - GHSA-5rm9-cc37-35gq",
                            "  * SECURITY UPDATE: udev: local root execution via malicious iscsi devices",
                            "    and unsanitized kernel output",
                            "    - GHSA-m8q3-73v4-wvg7.patch",
                            "    - GHSA-m8q3-73v4-wvg7",
                            "  * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure",
                            "    via systemd-machined",
                            "    - GHSA-2p9f-rcmv-x36h.patch",
                            "    - GHSA-2p9f-rcmv-x36h",
                            "  * SECURITY UPDATE: crash triggered by unprivileged users in various",
                            "    components via D-Bus/Varlink",
                            "    - core-limit-the-number-of-units-that-can-be-requested-over.patch",
                            "    - dbus-limit-the-number-of-env-variables-to-something-reaso.patch",
                            "    - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch",
                            "    - dns-question-limit-the-number-of-questions-per-query.patch",
                            "    - resolve-enforce-the-search-domain-limit-earlier.patch",
                            "    - resolve-limit-the-number-NTAs-to-something-sensible.patch",
                            "    - sd-bus-store-the-strv-size-when-extending-it.patch",
                            "    - sd-json-limit-the-number-of-env-variables-to-something-re.patch",
                            "    - sd-json-user-record-store-the-strv-size-when-extending-it.patch",
                            "    - GHSA-3jgj-3phh-hx5j",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Mon, 27 Jul 2026 16:44:02 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.",
                            "    Otherwise, the debhelper-generated systemd-tmpfiles call will include",
                            "    var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when",
                            "    the systemd package is upgraded. (LP: #2158686)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158686
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Wed, 22 Jul 2026 13:07:19 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)",
                            "  * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts",
                            "    (LP: #2157344)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157342,
                            2157344
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Thu, 18 Jun 2026 10:27:05 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)",
                            "    - units: order networkd resolve hook After=network-pre.target",
                            "    - units: drop Before=sockets.target from networkd resolve hook",
                            "  * core: Open netfilter socket only when needed (LP: #2150773)",
                            "  * mkosi: trim verity.sig json files to remove NUL padding before passing to jq",
                            "    (LP: #2155132)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148619,
                            2150773,
                            2155132
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Tue, 09 Jun 2026 08:59:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-headers-generic",
                "from_version": {
                    "source_package_name": "linux-meta",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": "linux-meta",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Main version: 7.0.0-30.30",
                            ""
                        ],
                        "package": "linux-meta",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:58 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-headers-virtual",
                "from_version": {
                    "source_package_name": "linux-meta",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": "linux-meta",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Main version: 7.0.0-30.30",
                            ""
                        ],
                        "package": "linux-meta",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:58 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-image-virtual",
                "from_version": {
                    "source_package_name": "linux-meta",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": "linux-meta",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Main version: 7.0.0-30.30",
                            ""
                        ],
                        "package": "linux-meta",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:58 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-libc-dev:armhf",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-64531",
                        "url": "https://ubuntu.com/security/CVE-2026-64531",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-27 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-46331",
                        "url": "https://ubuntu.com/security/CVE-2026-46331",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-16 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53212",
                        "url": "https://ubuntu.com/security/CVE-2026-53212",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53359",
                        "url": "https://ubuntu.com/security/CVE-2026-53359",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-04 12:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53131",
                        "url": "https://ubuntu.com/security/CVE-2026-53131",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53151",
                        "url": "https://ubuntu.com/security/CVE-2026-53151",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53175",
                        "url": "https://ubuntu.com/security/CVE-2026-53175",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53176",
                        "url": "https://ubuntu.com/security/CVE-2026-53176",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53186",
                        "url": "https://ubuntu.com/security/CVE-2026-53186",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53215",
                        "url": "https://ubuntu.com/security/CVE-2026-53215",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53216",
                        "url": "https://ubuntu.com/security/CVE-2026-53216",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53221",
                        "url": "https://ubuntu.com/security/CVE-2026-53221",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53224",
                        "url": "https://ubuntu.com/security/CVE-2026-53224",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53225",
                        "url": "https://ubuntu.com/security/CVE-2026-53225",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                        "cve_priority": "negligible",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53228",
                        "url": "https://ubuntu.com/security/CVE-2026-53228",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-52924",
                        "url": "https://ubuntu.com/security/CVE-2026-52924",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-24 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53246",
                        "url": "https://ubuntu.com/security/CVE-2026-53246",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53247",
                        "url": "https://ubuntu.com/security/CVE-2026-53247",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53260",
                        "url": "https://ubuntu.com/security/CVE-2026-53260",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2162185,
                    2160781,
                    1786013,
                    2158267
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-64531",
                                "url": "https://ubuntu.com/security/CVE-2026-64531",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-27 08:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)",
                            "",
                            "  * CVE-2026-64531",
                            "    - net: openvswitch: reject oversized nested action attrs",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162185
                        ],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:29 +0200"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-46331",
                                "url": "https://ubuntu.com/security/CVE-2026-46331",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-16 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53212",
                                "url": "https://ubuntu.com/security/CVE-2026-53212",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53359",
                                "url": "https://ubuntu.com/security/CVE-2026-53359",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-04 12:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53131",
                                "url": "https://ubuntu.com/security/CVE-2026-53131",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53151",
                                "url": "https://ubuntu.com/security/CVE-2026-53151",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53175",
                                "url": "https://ubuntu.com/security/CVE-2026-53175",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53176",
                                "url": "https://ubuntu.com/security/CVE-2026-53176",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53186",
                                "url": "https://ubuntu.com/security/CVE-2026-53186",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53215",
                                "url": "https://ubuntu.com/security/CVE-2026-53215",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53216",
                                "url": "https://ubuntu.com/security/CVE-2026-53216",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53221",
                                "url": "https://ubuntu.com/security/CVE-2026-53221",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53224",
                                "url": "https://ubuntu.com/security/CVE-2026-53224",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53225",
                                "url": "https://ubuntu.com/security/CVE-2026-53225",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                                "cve_priority": "negligible",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53228",
                                "url": "https://ubuntu.com/security/CVE-2026-53228",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-52924",
                                "url": "https://ubuntu.com/security/CVE-2026-52924",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-24 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53246",
                                "url": "https://ubuntu.com/security/CVE-2026-53246",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53247",
                                "url": "https://ubuntu.com/security/CVE-2026-53247",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53260",
                                "url": "https://ubuntu.com/security/CVE-2026-53260",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)",
                            "",
                            "  * Packaging resync (LP: #1786013)",
                            "    - [Packaging] update annotations scripts",
                            "",
                            "  * CVE-2026-46331",
                            "    - net/sched: fix pedit partial COW leading to page cache corruption",
                            "",
                            "  * CVE-2026-53212",
                            "    - netfilter: nft_tunnel: fix use-after-free on object destroy",
                            "",
                            "  * CVE-2026-53359",
                            "    - KVM: x86: Fix shadow paging use-after-free due to unexpected role",
                            "",
                            "  * CVE-2026-53131",
                            "    - netfilter: require Ethernet MAC header before using eth_hdr()",
                            "",
                            "  * CVE-2026-53151",
                            "    - rxrpc: Fix the ACK parser to extract the SACK table for parsing",
                            "",
                            "  * CVE-2026-53175",
                            "    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
                            "",
                            "  * CVE-2026-53176",
                            "    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
                            "",
                            "  * CVE-2026-53186",
                            "    - RDMA/srp: bound SRP_RSP sense copy by the received length",
                            "",
                            "  * CVE-2026-53215",
                            "    - net: mvpp2: refill RX buffers before XDP or skb use",
                            "",
                            "  * CVE-2026-53216",
                            "    - net: mvpp2: limit XDP frame size to the RX buffer",
                            "",
                            "  * CVE-2026-53221",
                            "    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
                            "",
                            "  * CVE-2026-53224",
                            "    - sctp: validate embedded INIT chunk and address list lengths in cookie",
                            "",
                            "  * CVE-2026-53225",
                            "    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
                            "",
                            "  * CVE-2026-53228",
                            "    - ipv6: sit: reload inner IPv6 header after GSO offloads",
                            "",
                            "  * CVE-2026-52924",
                            "    - sctp: purge outqueue on stale COOKIE-ECHO handling",
                            "",
                            "  * CVE-2026-53246",
                            "    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
                            "",
                            "  * CVE-2026-53247",
                            "    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
                            "",
                            "  * CVE-2026-53260",
                            "    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
                            "",
                            "  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)",
                            "    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-29.29",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2160781,
                            1786013,
                            2158267
                        ],
                        "author": "Manuel Diewald <manuel.diewald@canonical.com>",
                        "date": "Fri, 17 Jul 2026 18:57:53 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-tools-common",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-64531",
                        "url": "https://ubuntu.com/security/CVE-2026-64531",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-27 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-46331",
                        "url": "https://ubuntu.com/security/CVE-2026-46331",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-16 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53212",
                        "url": "https://ubuntu.com/security/CVE-2026-53212",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53359",
                        "url": "https://ubuntu.com/security/CVE-2026-53359",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-04 12:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53131",
                        "url": "https://ubuntu.com/security/CVE-2026-53131",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53151",
                        "url": "https://ubuntu.com/security/CVE-2026-53151",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53175",
                        "url": "https://ubuntu.com/security/CVE-2026-53175",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53176",
                        "url": "https://ubuntu.com/security/CVE-2026-53176",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53186",
                        "url": "https://ubuntu.com/security/CVE-2026-53186",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53215",
                        "url": "https://ubuntu.com/security/CVE-2026-53215",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53216",
                        "url": "https://ubuntu.com/security/CVE-2026-53216",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53221",
                        "url": "https://ubuntu.com/security/CVE-2026-53221",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53224",
                        "url": "https://ubuntu.com/security/CVE-2026-53224",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53225",
                        "url": "https://ubuntu.com/security/CVE-2026-53225",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                        "cve_priority": "negligible",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53228",
                        "url": "https://ubuntu.com/security/CVE-2026-53228",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-52924",
                        "url": "https://ubuntu.com/security/CVE-2026-52924",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-24 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53246",
                        "url": "https://ubuntu.com/security/CVE-2026-53246",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53247",
                        "url": "https://ubuntu.com/security/CVE-2026-53247",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53260",
                        "url": "https://ubuntu.com/security/CVE-2026-53260",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2162185,
                    2160781,
                    1786013,
                    2158267
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-64531",
                                "url": "https://ubuntu.com/security/CVE-2026-64531",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-27 08:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)",
                            "",
                            "  * CVE-2026-64531",
                            "    - net: openvswitch: reject oversized nested action attrs",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162185
                        ],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:29 +0200"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-46331",
                                "url": "https://ubuntu.com/security/CVE-2026-46331",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-16 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53212",
                                "url": "https://ubuntu.com/security/CVE-2026-53212",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53359",
                                "url": "https://ubuntu.com/security/CVE-2026-53359",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-04 12:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53131",
                                "url": "https://ubuntu.com/security/CVE-2026-53131",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53151",
                                "url": "https://ubuntu.com/security/CVE-2026-53151",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53175",
                                "url": "https://ubuntu.com/security/CVE-2026-53175",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53176",
                                "url": "https://ubuntu.com/security/CVE-2026-53176",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53186",
                                "url": "https://ubuntu.com/security/CVE-2026-53186",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53215",
                                "url": "https://ubuntu.com/security/CVE-2026-53215",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53216",
                                "url": "https://ubuntu.com/security/CVE-2026-53216",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53221",
                                "url": "https://ubuntu.com/security/CVE-2026-53221",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53224",
                                "url": "https://ubuntu.com/security/CVE-2026-53224",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53225",
                                "url": "https://ubuntu.com/security/CVE-2026-53225",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                                "cve_priority": "negligible",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53228",
                                "url": "https://ubuntu.com/security/CVE-2026-53228",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-52924",
                                "url": "https://ubuntu.com/security/CVE-2026-52924",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-24 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53246",
                                "url": "https://ubuntu.com/security/CVE-2026-53246",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53247",
                                "url": "https://ubuntu.com/security/CVE-2026-53247",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53260",
                                "url": "https://ubuntu.com/security/CVE-2026-53260",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)",
                            "",
                            "  * Packaging resync (LP: #1786013)",
                            "    - [Packaging] update annotations scripts",
                            "",
                            "  * CVE-2026-46331",
                            "    - net/sched: fix pedit partial COW leading to page cache corruption",
                            "",
                            "  * CVE-2026-53212",
                            "    - netfilter: nft_tunnel: fix use-after-free on object destroy",
                            "",
                            "  * CVE-2026-53359",
                            "    - KVM: x86: Fix shadow paging use-after-free due to unexpected role",
                            "",
                            "  * CVE-2026-53131",
                            "    - netfilter: require Ethernet MAC header before using eth_hdr()",
                            "",
                            "  * CVE-2026-53151",
                            "    - rxrpc: Fix the ACK parser to extract the SACK table for parsing",
                            "",
                            "  * CVE-2026-53175",
                            "    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
                            "",
                            "  * CVE-2026-53176",
                            "    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
                            "",
                            "  * CVE-2026-53186",
                            "    - RDMA/srp: bound SRP_RSP sense copy by the received length",
                            "",
                            "  * CVE-2026-53215",
                            "    - net: mvpp2: refill RX buffers before XDP or skb use",
                            "",
                            "  * CVE-2026-53216",
                            "    - net: mvpp2: limit XDP frame size to the RX buffer",
                            "",
                            "  * CVE-2026-53221",
                            "    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
                            "",
                            "  * CVE-2026-53224",
                            "    - sctp: validate embedded INIT chunk and address list lengths in cookie",
                            "",
                            "  * CVE-2026-53225",
                            "    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
                            "",
                            "  * CVE-2026-53228",
                            "    - ipv6: sit: reload inner IPv6 header after GSO offloads",
                            "",
                            "  * CVE-2026-52924",
                            "    - sctp: purge outqueue on stale COOKIE-ECHO handling",
                            "",
                            "  * CVE-2026-53246",
                            "    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
                            "",
                            "  * CVE-2026-53247",
                            "    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
                            "",
                            "  * CVE-2026-53260",
                            "    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
                            "",
                            "  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)",
                            "    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-29.29",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2160781,
                            1786013,
                            2158267
                        ],
                        "author": "Manuel Diewald <manuel.diewald@canonical.com>",
                        "date": "Fri, 17 Jul 2026 18:57:53 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-virtual",
                "from_version": {
                    "source_package_name": "linux-meta",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": "linux-meta",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Main version: 7.0.0-30.30",
                            ""
                        ],
                        "package": "linux-meta",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:58 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "packagekit",
                "from_version": {
                    "source_package_name": "packagekit",
                    "source_package_version": "1.3.4-3ubuntu1.1",
                    "version": "1.3.4-3ubuntu1.1"
                },
                "to_version": {
                    "source_package_name": "packagekit",
                    "source_package_version": "1.3.4-3ubuntu1.2",
                    "version": "1.3.4-3ubuntu1.2"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2148469
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Hector Cao ]",
                            "  * d/p/lp2148469-apt-use-solve-3.0.patch: use apt solver 3.0",
                            "    (LP: #2148469)",
                            "",
                            "  [ Alessandro Astone ]",
                            "  * d/p/pkgcli-Skip-blocked-updates-in-full-upgrade-too.patch.",
                            "    Fix `pkgcli upgrade` command after switching to apt solver 3.0, which would",
                            "    fail if some update was held back.",
                            ""
                        ],
                        "package": "packagekit",
                        "version": "1.3.4-3ubuntu1.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148469
                        ],
                        "author": "Alessandro Astone <alessandro.astone@canonical.com>",
                        "date": "Mon, 20 Jul 2026 13:28:13 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "snapd",
                "from_version": {
                    "source_package_name": "snapd",
                    "source_package_version": "2.76+ubuntu26.04.3",
                    "version": "2.76+ubuntu26.04.3"
                },
                "to_version": {
                    "source_package_name": "snapd",
                    "source_package_version": "2.76.3+ubuntu26.04",
                    "version": "2.76.3+ubuntu26.04"
                },
                "cves": [
                    {
                        "cve": "CVE-2024-5300",
                        "url": "https://ubuntu.com/security/CVE-2024-5300",
                        "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-21 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-3888",
                        "url": "https://ubuntu.com/security/CVE-2026-3888",
                        "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-03-17 14:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158301,
                    2159940,
                    2157692,
                    2067006
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * New upstream release, LP: #2158301",
                            "    - FDE: support keyboard configuration at install-time for first-boot",
                            "    - FDE: re-enable passphrases/PINs at install-time",
                            "    - FDE: require volumes authentication if HWROT is missing",
                            "    - FDE: bump secboot to rev 457b03a16d19",
                            "    - FDE: use new secboot API for reprovision TPM",
                            "    - Cross-distro: modify SELinux policy to use",
                            "      init_named_socket_activation() for allowing systemd to start snapd",
                            "      through socket activation",
                            "    - packaging: make sure that usr/bin/snap is built with correct build",
                            "      tags on debian sid",
                            "    - Ensure profiles are setup before running prepare-{slot, plug}*",
                            "      hooks",
                            ""
                        ],
                        "package": "snapd",
                        "version": "2.76.3+ubuntu26.04",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158301
                        ],
                        "author": "Katie May <katie.may@canonical.com>",
                        "date": "Tue, 07 Jul 2026 10:06:48 +0200"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * New upstream release, LP: #2159940",
                            "    - interfaces: steam-support, docker-support | fix mountinfo denial",
                            ""
                        ],
                        "package": "snapd",
                        "version": "2.76.2+ubuntu26.04",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2159940
                        ],
                        "author": "Katie May <katie.may@canonical.com>",
                        "date": "Tue, 07 Jul 2026 08:38:51 +0200"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2024-5300",
                                "url": "https://ubuntu.com/security/CVE-2024-5300",
                                "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-21 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-3888",
                                "url": "https://ubuntu.com/security/CVE-2026-3888",
                                "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-03-17 14:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * New upstream release, LP: #2157692",
                            "    - LP: #2067006 CVE-2024-5300",
                            "    - CVE-2026-3888",
                            ""
                        ],
                        "package": "snapd",
                        "version": "2.76.1+ubuntu26.04",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157692,
                            2067006
                        ],
                        "author": "Ernest Lotter <ernest.lotter@canonical.com>",
                        "date": "Thu, 25 Jun 2026 13:09:05 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "systemd",
                "from_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3",
                    "version": "259.5-0ubuntu3"
                },
                "to_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3.4",
                    "version": "259.5-0ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-16742",
                        "url": "https://ubuntu.com/security/CVE-2026-16742",
                        "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15059",
                        "url": "https://ubuntu.com/security/CVE-2026-15059",
                        "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15060",
                        "url": "https://ubuntu.com/security/CVE-2026-15060",
                        "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158686,
                    2157342,
                    2157344,
                    2148619,
                    2150773,
                    2155132
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-16742",
                                "url": "https://ubuntu.com/security/CVE-2026-16742",
                                "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15059",
                                "url": "https://ubuntu.com/security/CVE-2026-15059",
                                "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15060",
                                "url": "https://ubuntu.com/security/CVE-2026-15060",
                                "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: systemd-homed: local privilege escalation via missing",
                            "    home-record signature verification on the authenticate path",
                            "    - homed-fix-verification-of-local-identity-file.patch",
                            "    - homed-verify-privileged-worker-changes.patch",
                            "    - CVE-2026-16742",
                            "  * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary",
                            "    processes",
                            "    - CVE-2026-15059.patch",
                            "    - CVE-2026-15059",
                            "  * SECURITY UPDATE: systemd-machined: unprivileged users can terminate",
                            "    arbitrary processes",
                            "    - CVE-2026-15060.patch",
                            "    - CVE-2026-15060",
                            "  * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various",
                            "    components via Varlink",
                            "    - GHSA-5rm9-cc37-35gq.patch",
                            "    - GHSA-5rm9-cc37-35gq",
                            "  * SECURITY UPDATE: udev: local root execution via malicious iscsi devices",
                            "    and unsanitized kernel output",
                            "    - GHSA-m8q3-73v4-wvg7.patch",
                            "    - GHSA-m8q3-73v4-wvg7",
                            "  * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure",
                            "    via systemd-machined",
                            "    - GHSA-2p9f-rcmv-x36h.patch",
                            "    - GHSA-2p9f-rcmv-x36h",
                            "  * SECURITY UPDATE: crash triggered by unprivileged users in various",
                            "    components via D-Bus/Varlink",
                            "    - core-limit-the-number-of-units-that-can-be-requested-over.patch",
                            "    - dbus-limit-the-number-of-env-variables-to-something-reaso.patch",
                            "    - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch",
                            "    - dns-question-limit-the-number-of-questions-per-query.patch",
                            "    - resolve-enforce-the-search-domain-limit-earlier.patch",
                            "    - resolve-limit-the-number-NTAs-to-something-sensible.patch",
                            "    - sd-bus-store-the-strv-size-when-extending-it.patch",
                            "    - sd-json-limit-the-number-of-env-variables-to-something-re.patch",
                            "    - sd-json-user-record-store-the-strv-size-when-extending-it.patch",
                            "    - GHSA-3jgj-3phh-hx5j",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Mon, 27 Jul 2026 16:44:02 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.",
                            "    Otherwise, the debhelper-generated systemd-tmpfiles call will include",
                            "    var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when",
                            "    the systemd package is upgraded. (LP: #2158686)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158686
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Wed, 22 Jul 2026 13:07:19 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)",
                            "  * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts",
                            "    (LP: #2157344)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157342,
                            2157344
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Thu, 18 Jun 2026 10:27:05 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)",
                            "    - units: order networkd resolve hook After=network-pre.target",
                            "    - units: drop Before=sockets.target from networkd resolve hook",
                            "  * core: Open netfilter socket only when needed (LP: #2150773)",
                            "  * mkosi: trim verity.sig json files to remove NUL padding before passing to jq",
                            "    (LP: #2155132)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148619,
                            2150773,
                            2155132
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Tue, 09 Jun 2026 08:59:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "systemd-cryptsetup",
                "from_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3",
                    "version": "259.5-0ubuntu3"
                },
                "to_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3.4",
                    "version": "259.5-0ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-16742",
                        "url": "https://ubuntu.com/security/CVE-2026-16742",
                        "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15059",
                        "url": "https://ubuntu.com/security/CVE-2026-15059",
                        "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15060",
                        "url": "https://ubuntu.com/security/CVE-2026-15060",
                        "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158686,
                    2157342,
                    2157344,
                    2148619,
                    2150773,
                    2155132
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-16742",
                                "url": "https://ubuntu.com/security/CVE-2026-16742",
                                "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15059",
                                "url": "https://ubuntu.com/security/CVE-2026-15059",
                                "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15060",
                                "url": "https://ubuntu.com/security/CVE-2026-15060",
                                "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: systemd-homed: local privilege escalation via missing",
                            "    home-record signature verification on the authenticate path",
                            "    - homed-fix-verification-of-local-identity-file.patch",
                            "    - homed-verify-privileged-worker-changes.patch",
                            "    - CVE-2026-16742",
                            "  * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary",
                            "    processes",
                            "    - CVE-2026-15059.patch",
                            "    - CVE-2026-15059",
                            "  * SECURITY UPDATE: systemd-machined: unprivileged users can terminate",
                            "    arbitrary processes",
                            "    - CVE-2026-15060.patch",
                            "    - CVE-2026-15060",
                            "  * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various",
                            "    components via Varlink",
                            "    - GHSA-5rm9-cc37-35gq.patch",
                            "    - GHSA-5rm9-cc37-35gq",
                            "  * SECURITY UPDATE: udev: local root execution via malicious iscsi devices",
                            "    and unsanitized kernel output",
                            "    - GHSA-m8q3-73v4-wvg7.patch",
                            "    - GHSA-m8q3-73v4-wvg7",
                            "  * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure",
                            "    via systemd-machined",
                            "    - GHSA-2p9f-rcmv-x36h.patch",
                            "    - GHSA-2p9f-rcmv-x36h",
                            "  * SECURITY UPDATE: crash triggered by unprivileged users in various",
                            "    components via D-Bus/Varlink",
                            "    - core-limit-the-number-of-units-that-can-be-requested-over.patch",
                            "    - dbus-limit-the-number-of-env-variables-to-something-reaso.patch",
                            "    - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch",
                            "    - dns-question-limit-the-number-of-questions-per-query.patch",
                            "    - resolve-enforce-the-search-domain-limit-earlier.patch",
                            "    - resolve-limit-the-number-NTAs-to-something-sensible.patch",
                            "    - sd-bus-store-the-strv-size-when-extending-it.patch",
                            "    - sd-json-limit-the-number-of-env-variables-to-something-re.patch",
                            "    - sd-json-user-record-store-the-strv-size-when-extending-it.patch",
                            "    - GHSA-3jgj-3phh-hx5j",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Mon, 27 Jul 2026 16:44:02 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.",
                            "    Otherwise, the debhelper-generated systemd-tmpfiles call will include",
                            "    var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when",
                            "    the systemd package is upgraded. (LP: #2158686)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158686
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Wed, 22 Jul 2026 13:07:19 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)",
                            "  * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts",
                            "    (LP: #2157344)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157342,
                            2157344
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Thu, 18 Jun 2026 10:27:05 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)",
                            "    - units: order networkd resolve hook After=network-pre.target",
                            "    - units: drop Before=sockets.target from networkd resolve hook",
                            "  * core: Open netfilter socket only when needed (LP: #2150773)",
                            "  * mkosi: trim verity.sig json files to remove NUL padding before passing to jq",
                            "    (LP: #2155132)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148619,
                            2150773,
                            2155132
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Tue, 09 Jun 2026 08:59:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "systemd-resolved",
                "from_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3",
                    "version": "259.5-0ubuntu3"
                },
                "to_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3.4",
                    "version": "259.5-0ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-16742",
                        "url": "https://ubuntu.com/security/CVE-2026-16742",
                        "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15059",
                        "url": "https://ubuntu.com/security/CVE-2026-15059",
                        "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15060",
                        "url": "https://ubuntu.com/security/CVE-2026-15060",
                        "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158686,
                    2157342,
                    2157344,
                    2148619,
                    2150773,
                    2155132
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-16742",
                                "url": "https://ubuntu.com/security/CVE-2026-16742",
                                "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15059",
                                "url": "https://ubuntu.com/security/CVE-2026-15059",
                                "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15060",
                                "url": "https://ubuntu.com/security/CVE-2026-15060",
                                "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: systemd-homed: local privilege escalation via missing",
                            "    home-record signature verification on the authenticate path",
                            "    - homed-fix-verification-of-local-identity-file.patch",
                            "    - homed-verify-privileged-worker-changes.patch",
                            "    - CVE-2026-16742",
                            "  * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary",
                            "    processes",
                            "    - CVE-2026-15059.patch",
                            "    - CVE-2026-15059",
                            "  * SECURITY UPDATE: systemd-machined: unprivileged users can terminate",
                            "    arbitrary processes",
                            "    - CVE-2026-15060.patch",
                            "    - CVE-2026-15060",
                            "  * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various",
                            "    components via Varlink",
                            "    - GHSA-5rm9-cc37-35gq.patch",
                            "    - GHSA-5rm9-cc37-35gq",
                            "  * SECURITY UPDATE: udev: local root execution via malicious iscsi devices",
                            "    and unsanitized kernel output",
                            "    - GHSA-m8q3-73v4-wvg7.patch",
                            "    - GHSA-m8q3-73v4-wvg7",
                            "  * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure",
                            "    via systemd-machined",
                            "    - GHSA-2p9f-rcmv-x36h.patch",
                            "    - GHSA-2p9f-rcmv-x36h",
                            "  * SECURITY UPDATE: crash triggered by unprivileged users in various",
                            "    components via D-Bus/Varlink",
                            "    - core-limit-the-number-of-units-that-can-be-requested-over.patch",
                            "    - dbus-limit-the-number-of-env-variables-to-something-reaso.patch",
                            "    - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch",
                            "    - dns-question-limit-the-number-of-questions-per-query.patch",
                            "    - resolve-enforce-the-search-domain-limit-earlier.patch",
                            "    - resolve-limit-the-number-NTAs-to-something-sensible.patch",
                            "    - sd-bus-store-the-strv-size-when-extending-it.patch",
                            "    - sd-json-limit-the-number-of-env-variables-to-something-re.patch",
                            "    - sd-json-user-record-store-the-strv-size-when-extending-it.patch",
                            "    - GHSA-3jgj-3phh-hx5j",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Mon, 27 Jul 2026 16:44:02 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.",
                            "    Otherwise, the debhelper-generated systemd-tmpfiles call will include",
                            "    var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when",
                            "    the systemd package is upgraded. (LP: #2158686)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158686
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Wed, 22 Jul 2026 13:07:19 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)",
                            "  * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts",
                            "    (LP: #2157344)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157342,
                            2157344
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Thu, 18 Jun 2026 10:27:05 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)",
                            "    - units: order networkd resolve hook After=network-pre.target",
                            "    - units: drop Before=sockets.target from networkd resolve hook",
                            "  * core: Open netfilter socket only when needed (LP: #2150773)",
                            "  * mkosi: trim verity.sig json files to remove NUL padding before passing to jq",
                            "    (LP: #2155132)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148619,
                            2150773,
                            2155132
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Tue, 09 Jun 2026 08:59:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "systemd-sysv",
                "from_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3",
                    "version": "259.5-0ubuntu3"
                },
                "to_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3.4",
                    "version": "259.5-0ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-16742",
                        "url": "https://ubuntu.com/security/CVE-2026-16742",
                        "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15059",
                        "url": "https://ubuntu.com/security/CVE-2026-15059",
                        "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15060",
                        "url": "https://ubuntu.com/security/CVE-2026-15060",
                        "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158686,
                    2157342,
                    2157344,
                    2148619,
                    2150773,
                    2155132
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-16742",
                                "url": "https://ubuntu.com/security/CVE-2026-16742",
                                "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15059",
                                "url": "https://ubuntu.com/security/CVE-2026-15059",
                                "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15060",
                                "url": "https://ubuntu.com/security/CVE-2026-15060",
                                "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: systemd-homed: local privilege escalation via missing",
                            "    home-record signature verification on the authenticate path",
                            "    - homed-fix-verification-of-local-identity-file.patch",
                            "    - homed-verify-privileged-worker-changes.patch",
                            "    - CVE-2026-16742",
                            "  * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary",
                            "    processes",
                            "    - CVE-2026-15059.patch",
                            "    - CVE-2026-15059",
                            "  * SECURITY UPDATE: systemd-machined: unprivileged users can terminate",
                            "    arbitrary processes",
                            "    - CVE-2026-15060.patch",
                            "    - CVE-2026-15060",
                            "  * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various",
                            "    components via Varlink",
                            "    - GHSA-5rm9-cc37-35gq.patch",
                            "    - GHSA-5rm9-cc37-35gq",
                            "  * SECURITY UPDATE: udev: local root execution via malicious iscsi devices",
                            "    and unsanitized kernel output",
                            "    - GHSA-m8q3-73v4-wvg7.patch",
                            "    - GHSA-m8q3-73v4-wvg7",
                            "  * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure",
                            "    via systemd-machined",
                            "    - GHSA-2p9f-rcmv-x36h.patch",
                            "    - GHSA-2p9f-rcmv-x36h",
                            "  * SECURITY UPDATE: crash triggered by unprivileged users in various",
                            "    components via D-Bus/Varlink",
                            "    - core-limit-the-number-of-units-that-can-be-requested-over.patch",
                            "    - dbus-limit-the-number-of-env-variables-to-something-reaso.patch",
                            "    - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch",
                            "    - dns-question-limit-the-number-of-questions-per-query.patch",
                            "    - resolve-enforce-the-search-domain-limit-earlier.patch",
                            "    - resolve-limit-the-number-NTAs-to-something-sensible.patch",
                            "    - sd-bus-store-the-strv-size-when-extending-it.patch",
                            "    - sd-json-limit-the-number-of-env-variables-to-something-re.patch",
                            "    - sd-json-user-record-store-the-strv-size-when-extending-it.patch",
                            "    - GHSA-3jgj-3phh-hx5j",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Mon, 27 Jul 2026 16:44:02 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.",
                            "    Otherwise, the debhelper-generated systemd-tmpfiles call will include",
                            "    var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when",
                            "    the systemd package is upgraded. (LP: #2158686)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158686
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Wed, 22 Jul 2026 13:07:19 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)",
                            "  * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts",
                            "    (LP: #2157344)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157342,
                            2157344
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Thu, 18 Jun 2026 10:27:05 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)",
                            "    - units: order networkd resolve hook After=network-pre.target",
                            "    - units: drop Before=sockets.target from networkd resolve hook",
                            "  * core: Open netfilter socket only when needed (LP: #2150773)",
                            "  * mkosi: trim verity.sig json files to remove NUL padding before passing to jq",
                            "    (LP: #2155132)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148619,
                            2150773,
                            2155132
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Tue, 09 Jun 2026 08:59:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "ubuntu-kernel-accessories",
                "from_version": {
                    "source_package_name": "ubuntu-meta",
                    "source_package_version": "1.570.2",
                    "version": "1.570.2"
                },
                "to_version": {
                    "source_package_name": "ubuntu-meta",
                    "source_package_version": "1.570.3",
                    "version": "1.570.3"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2162040
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Gauthier Jolly ]",
                            "  * Refreshed dependencies",
                            "  * Added curl explicitly to cloud-minimal and server-minimal after it was",
                            "    implicity removed with pollinate's removal (LP: #2162040)",
                            ""
                        ],
                        "package": "ubuntu-meta",
                        "version": "1.570.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162040
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Fri, 31 Jul 2026 08:59:55 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "ubuntu-minimal",
                "from_version": {
                    "source_package_name": "ubuntu-meta",
                    "source_package_version": "1.570.2",
                    "version": "1.570.2"
                },
                "to_version": {
                    "source_package_name": "ubuntu-meta",
                    "source_package_version": "1.570.3",
                    "version": "1.570.3"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2162040
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Gauthier Jolly ]",
                            "  * Refreshed dependencies",
                            "  * Added curl explicitly to cloud-minimal and server-minimal after it was",
                            "    implicity removed with pollinate's removal (LP: #2162040)",
                            ""
                        ],
                        "package": "ubuntu-meta",
                        "version": "1.570.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162040
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Fri, 31 Jul 2026 08:59:55 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "ubuntu-server",
                "from_version": {
                    "source_package_name": "ubuntu-meta",
                    "source_package_version": "1.570.2",
                    "version": "1.570.2"
                },
                "to_version": {
                    "source_package_name": "ubuntu-meta",
                    "source_package_version": "1.570.3",
                    "version": "1.570.3"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2162040
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Gauthier Jolly ]",
                            "  * Refreshed dependencies",
                            "  * Added curl explicitly to cloud-minimal and server-minimal after it was",
                            "    implicity removed with pollinate's removal (LP: #2162040)",
                            ""
                        ],
                        "package": "ubuntu-meta",
                        "version": "1.570.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162040
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Fri, 31 Jul 2026 08:59:55 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "ubuntu-standard",
                "from_version": {
                    "source_package_name": "ubuntu-meta",
                    "source_package_version": "1.570.2",
                    "version": "1.570.2"
                },
                "to_version": {
                    "source_package_name": "ubuntu-meta",
                    "source_package_version": "1.570.3",
                    "version": "1.570.3"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2162040
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Gauthier Jolly ]",
                            "  * Refreshed dependencies",
                            "  * Added curl explicitly to cloud-minimal and server-minimal after it was",
                            "    implicity removed with pollinate's removal (LP: #2162040)",
                            ""
                        ],
                        "package": "ubuntu-meta",
                        "version": "1.570.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162040
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Fri, 31 Jul 2026 08:59:55 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "udev",
                "from_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3",
                    "version": "259.5-0ubuntu3"
                },
                "to_version": {
                    "source_package_name": "systemd",
                    "source_package_version": "259.5-0ubuntu3.4",
                    "version": "259.5-0ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-16742",
                        "url": "https://ubuntu.com/security/CVE-2026-16742",
                        "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15059",
                        "url": "https://ubuntu.com/security/CVE-2026-15059",
                        "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-15060",
                        "url": "https://ubuntu.com/security/CVE-2026-15060",
                        "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 14:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2158686,
                    2157342,
                    2157344,
                    2148619,
                    2150773,
                    2155132
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-16742",
                                "url": "https://ubuntu.com/security/CVE-2026-16742",
                                "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15059",
                                "url": "https://ubuntu.com/security/CVE-2026-15059",
                                "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-15060",
                                "url": "https://ubuntu.com/security/CVE-2026-15060",
                                "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.  - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 14:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: systemd-homed: local privilege escalation via missing",
                            "    home-record signature verification on the authenticate path",
                            "    - homed-fix-verification-of-local-identity-file.patch",
                            "    - homed-verify-privileged-worker-changes.patch",
                            "    - CVE-2026-16742",
                            "  * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary",
                            "    processes",
                            "    - CVE-2026-15059.patch",
                            "    - CVE-2026-15059",
                            "  * SECURITY UPDATE: systemd-machined: unprivileged users can terminate",
                            "    arbitrary processes",
                            "    - CVE-2026-15060.patch",
                            "    - CVE-2026-15060",
                            "  * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various",
                            "    components via Varlink",
                            "    - GHSA-5rm9-cc37-35gq.patch",
                            "    - GHSA-5rm9-cc37-35gq",
                            "  * SECURITY UPDATE: udev: local root execution via malicious iscsi devices",
                            "    and unsanitized kernel output",
                            "    - GHSA-m8q3-73v4-wvg7.patch",
                            "    - GHSA-m8q3-73v4-wvg7",
                            "  * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure",
                            "    via systemd-machined",
                            "    - GHSA-2p9f-rcmv-x36h.patch",
                            "    - GHSA-2p9f-rcmv-x36h",
                            "  * SECURITY UPDATE: crash triggered by unprivileged users in various",
                            "    components via D-Bus/Varlink",
                            "    - core-limit-the-number-of-units-that-can-be-requested-over.patch",
                            "    - dbus-limit-the-number-of-env-variables-to-something-reaso.patch",
                            "    - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch",
                            "    - dns-question-limit-the-number-of-questions-per-query.patch",
                            "    - resolve-enforce-the-search-domain-limit-earlier.patch",
                            "    - resolve-limit-the-number-NTAs-to-something-sensible.patch",
                            "    - sd-bus-store-the-strv-size-when-extending-it.patch",
                            "    - sd-json-limit-the-number-of-env-variables-to-something-re.patch",
                            "    - sd-json-user-record-store-the-strv-size-when-extending-it.patch",
                            "    - GHSA-3jgj-3phh-hx5j",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Mon, 27 Jul 2026 16:44:02 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.",
                            "    Otherwise, the debhelper-generated systemd-tmpfiles call will include",
                            "    var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when",
                            "    the systemd package is upgraded. (LP: #2158686)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.3",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2158686
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Wed, 22 Jul 2026 13:07:19 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)",
                            "  * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts",
                            "    (LP: #2157344)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2157342,
                            2157344
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Thu, 18 Jun 2026 10:27:05 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)",
                            "    - units: order networkd resolve hook After=network-pre.target",
                            "    - units: drop Before=sockets.target from networkd resolve hook",
                            "  * core: Open netfilter socket only when needed (LP: #2150773)",
                            "  * mkosi: trim verity.sig json files to remove NUL padding before passing to jq",
                            "    (LP: #2155132)",
                            ""
                        ],
                        "package": "systemd",
                        "version": "259.5-0ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2148619,
                            2150773,
                            2155132
                        ],
                        "author": "Nick Rosbrook <enr0n@ubuntu.com>",
                        "date": "Tue, 09 Jun 2026 08:59:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "vim",
                "from_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:9.1.2141-1ubuntu4.7",
                    "version": "2:9.1.2141-1ubuntu4.7"
                },
                "to_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:9.1.2141-1ubuntu4.8",
                    "version": "2:9.1.2141-1ubuntu4.8"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-73071",
                        "url": "https://ubuntu.com/security/CVE-2026-73071",
                        "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73072",
                        "url": "https://ubuntu.com/security/CVE-2026-73072",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73074",
                        "url": "https://ubuntu.com/security/CVE-2026-73074",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73076",
                        "url": "https://ubuntu.com/security/CVE-2026-73076",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73077",
                        "url": "https://ubuntu.com/security/CVE-2026-73077",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73078",
                        "url": "https://ubuntu.com/security/CVE-2026-73078",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-28417",
                        "url": "https://ubuntu.com/security/CVE-2026-28417",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-02-27 22:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-42307",
                        "url": "https://ubuntu.com/security/CVE-2026-42307",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-08 23:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-73071",
                                "url": "https://ubuntu.com/security/CVE-2026-73071",
                                "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73072",
                                "url": "https://ubuntu.com/security/CVE-2026-73072",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73074",
                                "url": "https://ubuntu.com/security/CVE-2026-73074",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73076",
                                "url": "https://ubuntu.com/security/CVE-2026-73076",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73077",
                                "url": "https://ubuntu.com/security/CVE-2026-73077",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73078",
                                "url": "https://ubuntu.com/security/CVE-2026-73078",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-28417",
                                "url": "https://ubuntu.com/security/CVE-2026-28417",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-02-27 22:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-42307",
                                "url": "https://ubuntu.com/security/CVE-2026-42307",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-08 23:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Use-after-free on json decode error.",
                            "    - debian/patches/CVE-2026-73071.patch: Report the position from the",
                            "      current reader in src/json.c.",
                            "    - CVE-2026-73071",
                            "  * SECURITY UPDATE: Heap buffer overflow in set_sofo().",
                            "    - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in",
                            "      src/spellfile.c.",
                            "    - CVE-2026-73072",
                            "  * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.",
                            "    - debian/patches/CVE-2026-73074.patch: Verify that the number of text",
                            "      properties falls within the limit in src/errors.h and src/textprop.c.",
                            "    - CVE-2026-73074",
                            "  * SECURITY UPDATE: Code execution via VimballRecord file.",
                            "    - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix",
                            "      broken directory deletion code, and refactor code in",
                            "      runtime/autoload/vimball.vim",
                            "    - CVE-2026-73076",
                            "  * SECURITY UPDATE: Arbitrary code execution via keyword lookup.",
                            "    - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands",
                            "      using single quotes, for sh/zsh pass the argument as a separate list",
                            "      item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,",
                            "      and ../zsh.vim.",
                            "    - CVE-2026-73077",
                            "  * SECURITY UPDATE: Code injection in netrw via bookmarks.",
                            "    - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in",
                            "      runtime/pack/dist/opt/netrw/autoload/netrw.vim.",
                            "    - CVE-2026-73078",
                            "  * debian/patches/CVE-2026-28417.patch: Add test cases.",
                            "  * debian/patches/CVE-2026-42307.patch: Refresh to align with CVE-2026-28417",
                            ""
                        ],
                        "package": "vim",
                        "version": "2:9.1.2141-1ubuntu4.8",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 12:55:02 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "vim-common",
                "from_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:9.1.2141-1ubuntu4.7",
                    "version": "2:9.1.2141-1ubuntu4.7"
                },
                "to_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:9.1.2141-1ubuntu4.8",
                    "version": "2:9.1.2141-1ubuntu4.8"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-73071",
                        "url": "https://ubuntu.com/security/CVE-2026-73071",
                        "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73072",
                        "url": "https://ubuntu.com/security/CVE-2026-73072",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73074",
                        "url": "https://ubuntu.com/security/CVE-2026-73074",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73076",
                        "url": "https://ubuntu.com/security/CVE-2026-73076",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73077",
                        "url": "https://ubuntu.com/security/CVE-2026-73077",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73078",
                        "url": "https://ubuntu.com/security/CVE-2026-73078",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-28417",
                        "url": "https://ubuntu.com/security/CVE-2026-28417",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-02-27 22:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-42307",
                        "url": "https://ubuntu.com/security/CVE-2026-42307",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-08 23:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-73071",
                                "url": "https://ubuntu.com/security/CVE-2026-73071",
                                "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73072",
                                "url": "https://ubuntu.com/security/CVE-2026-73072",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73074",
                                "url": "https://ubuntu.com/security/CVE-2026-73074",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73076",
                                "url": "https://ubuntu.com/security/CVE-2026-73076",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73077",
                                "url": "https://ubuntu.com/security/CVE-2026-73077",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73078",
                                "url": "https://ubuntu.com/security/CVE-2026-73078",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-28417",
                                "url": "https://ubuntu.com/security/CVE-2026-28417",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-02-27 22:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-42307",
                                "url": "https://ubuntu.com/security/CVE-2026-42307",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-08 23:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Use-after-free on json decode error.",
                            "    - debian/patches/CVE-2026-73071.patch: Report the position from the",
                            "      current reader in src/json.c.",
                            "    - CVE-2026-73071",
                            "  * SECURITY UPDATE: Heap buffer overflow in set_sofo().",
                            "    - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in",
                            "      src/spellfile.c.",
                            "    - CVE-2026-73072",
                            "  * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.",
                            "    - debian/patches/CVE-2026-73074.patch: Verify that the number of text",
                            "      properties falls within the limit in src/errors.h and src/textprop.c.",
                            "    - CVE-2026-73074",
                            "  * SECURITY UPDATE: Code execution via VimballRecord file.",
                            "    - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix",
                            "      broken directory deletion code, and refactor code in",
                            "      runtime/autoload/vimball.vim",
                            "    - CVE-2026-73076",
                            "  * SECURITY UPDATE: Arbitrary code execution via keyword lookup.",
                            "    - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands",
                            "      using single quotes, for sh/zsh pass the argument as a separate list",
                            "      item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,",
                            "      and ../zsh.vim.",
                            "    - CVE-2026-73077",
                            "  * SECURITY UPDATE: Code injection in netrw via bookmarks.",
                            "    - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in",
                            "      runtime/pack/dist/opt/netrw/autoload/netrw.vim.",
                            "    - CVE-2026-73078",
                            "  * debian/patches/CVE-2026-28417.patch: Add test cases.",
                            "  * debian/patches/CVE-2026-42307.patch: Refresh to align with CVE-2026-28417",
                            ""
                        ],
                        "package": "vim",
                        "version": "2:9.1.2141-1ubuntu4.8",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 12:55:02 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "vim-runtime",
                "from_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:9.1.2141-1ubuntu4.7",
                    "version": "2:9.1.2141-1ubuntu4.7"
                },
                "to_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:9.1.2141-1ubuntu4.8",
                    "version": "2:9.1.2141-1ubuntu4.8"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-73071",
                        "url": "https://ubuntu.com/security/CVE-2026-73071",
                        "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73072",
                        "url": "https://ubuntu.com/security/CVE-2026-73072",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73074",
                        "url": "https://ubuntu.com/security/CVE-2026-73074",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73076",
                        "url": "https://ubuntu.com/security/CVE-2026-73076",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73077",
                        "url": "https://ubuntu.com/security/CVE-2026-73077",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73078",
                        "url": "https://ubuntu.com/security/CVE-2026-73078",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-28417",
                        "url": "https://ubuntu.com/security/CVE-2026-28417",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-02-27 22:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-42307",
                        "url": "https://ubuntu.com/security/CVE-2026-42307",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-08 23:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-73071",
                                "url": "https://ubuntu.com/security/CVE-2026-73071",
                                "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73072",
                                "url": "https://ubuntu.com/security/CVE-2026-73072",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73074",
                                "url": "https://ubuntu.com/security/CVE-2026-73074",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73076",
                                "url": "https://ubuntu.com/security/CVE-2026-73076",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73077",
                                "url": "https://ubuntu.com/security/CVE-2026-73077",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73078",
                                "url": "https://ubuntu.com/security/CVE-2026-73078",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-28417",
                                "url": "https://ubuntu.com/security/CVE-2026-28417",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-02-27 22:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-42307",
                                "url": "https://ubuntu.com/security/CVE-2026-42307",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-08 23:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Use-after-free on json decode error.",
                            "    - debian/patches/CVE-2026-73071.patch: Report the position from the",
                            "      current reader in src/json.c.",
                            "    - CVE-2026-73071",
                            "  * SECURITY UPDATE: Heap buffer overflow in set_sofo().",
                            "    - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in",
                            "      src/spellfile.c.",
                            "    - CVE-2026-73072",
                            "  * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.",
                            "    - debian/patches/CVE-2026-73074.patch: Verify that the number of text",
                            "      properties falls within the limit in src/errors.h and src/textprop.c.",
                            "    - CVE-2026-73074",
                            "  * SECURITY UPDATE: Code execution via VimballRecord file.",
                            "    - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix",
                            "      broken directory deletion code, and refactor code in",
                            "      runtime/autoload/vimball.vim",
                            "    - CVE-2026-73076",
                            "  * SECURITY UPDATE: Arbitrary code execution via keyword lookup.",
                            "    - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands",
                            "      using single quotes, for sh/zsh pass the argument as a separate list",
                            "      item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,",
                            "      and ../zsh.vim.",
                            "    - CVE-2026-73077",
                            "  * SECURITY UPDATE: Code injection in netrw via bookmarks.",
                            "    - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in",
                            "      runtime/pack/dist/opt/netrw/autoload/netrw.vim.",
                            "    - CVE-2026-73078",
                            "  * debian/patches/CVE-2026-28417.patch: Add test cases.",
                            "  * debian/patches/CVE-2026-42307.patch: Refresh to align with CVE-2026-28417",
                            ""
                        ],
                        "package": "vim",
                        "version": "2:9.1.2141-1ubuntu4.8",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 12:55:02 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "vim-tiny",
                "from_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:9.1.2141-1ubuntu4.7",
                    "version": "2:9.1.2141-1ubuntu4.7"
                },
                "to_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:9.1.2141-1ubuntu4.8",
                    "version": "2:9.1.2141-1ubuntu4.8"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-73071",
                        "url": "https://ubuntu.com/security/CVE-2026-73071",
                        "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73072",
                        "url": "https://ubuntu.com/security/CVE-2026-73072",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73074",
                        "url": "https://ubuntu.com/security/CVE-2026-73074",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73076",
                        "url": "https://ubuntu.com/security/CVE-2026-73076",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73077",
                        "url": "https://ubuntu.com/security/CVE-2026-73077",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73078",
                        "url": "https://ubuntu.com/security/CVE-2026-73078",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-28417",
                        "url": "https://ubuntu.com/security/CVE-2026-28417",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-02-27 22:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-42307",
                        "url": "https://ubuntu.com/security/CVE-2026-42307",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-08 23:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-73071",
                                "url": "https://ubuntu.com/security/CVE-2026-73071",
                                "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73072",
                                "url": "https://ubuntu.com/security/CVE-2026-73072",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73074",
                                "url": "https://ubuntu.com/security/CVE-2026-73074",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73076",
                                "url": "https://ubuntu.com/security/CVE-2026-73076",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73077",
                                "url": "https://ubuntu.com/security/CVE-2026-73077",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73078",
                                "url": "https://ubuntu.com/security/CVE-2026-73078",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-28417",
                                "url": "https://ubuntu.com/security/CVE-2026-28417",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-02-27 22:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-42307",
                                "url": "https://ubuntu.com/security/CVE-2026-42307",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-08 23:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Use-after-free on json decode error.",
                            "    - debian/patches/CVE-2026-73071.patch: Report the position from the",
                            "      current reader in src/json.c.",
                            "    - CVE-2026-73071",
                            "  * SECURITY UPDATE: Heap buffer overflow in set_sofo().",
                            "    - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in",
                            "      src/spellfile.c.",
                            "    - CVE-2026-73072",
                            "  * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.",
                            "    - debian/patches/CVE-2026-73074.patch: Verify that the number of text",
                            "      properties falls within the limit in src/errors.h and src/textprop.c.",
                            "    - CVE-2026-73074",
                            "  * SECURITY UPDATE: Code execution via VimballRecord file.",
                            "    - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix",
                            "      broken directory deletion code, and refactor code in",
                            "      runtime/autoload/vimball.vim",
                            "    - CVE-2026-73076",
                            "  * SECURITY UPDATE: Arbitrary code execution via keyword lookup.",
                            "    - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands",
                            "      using single quotes, for sh/zsh pass the argument as a separate list",
                            "      item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,",
                            "      and ../zsh.vim.",
                            "    - CVE-2026-73077",
                            "  * SECURITY UPDATE: Code injection in netrw via bookmarks.",
                            "    - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in",
                            "      runtime/pack/dist/opt/netrw/autoload/netrw.vim.",
                            "    - CVE-2026-73078",
                            "  * debian/patches/CVE-2026-28417.patch: Add test cases.",
                            "  * debian/patches/CVE-2026-42307.patch: Refresh to align with CVE-2026-28417",
                            ""
                        ],
                        "package": "vim",
                        "version": "2:9.1.2141-1ubuntu4.8",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 12:55:02 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "wget",
                "from_version": {
                    "source_package_name": "wget",
                    "source_package_version": "1.25.0-2ubuntu4.3",
                    "version": "1.25.0-2ubuntu4.3"
                },
                "to_version": {
                    "source_package_name": "wget",
                    "source_package_version": "1.25.0-2ubuntu4.4",
                    "version": "1.25.0-2ubuntu4.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-58472",
                        "url": "https://ubuntu.com/security/CVE-2026-58472",
                        "cve_description": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-07 21:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2163754
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-58472",
                                "url": "https://ubuntu.com/security/CVE-2026-58472",
                                "cve_description": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-07 21:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY REGRESSION: Incomplete fix for CVE-2026-58472 (LP: #2163754)",
                            "    - debian/patches/CVE-2026-58472-post1.patch: Fix buffer overflow in",
                            "      src/convert.c",
                            ""
                        ],
                        "package": "wget",
                        "version": "1.25.0-2ubuntu4.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [
                            2163754
                        ],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Wed, 19 Aug 2026 17:59:21 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "xxd",
                "from_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:9.1.2141-1ubuntu4.7",
                    "version": "2:9.1.2141-1ubuntu4.7"
                },
                "to_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:9.1.2141-1ubuntu4.8",
                    "version": "2:9.1.2141-1ubuntu4.8"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-73071",
                        "url": "https://ubuntu.com/security/CVE-2026-73071",
                        "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73072",
                        "url": "https://ubuntu.com/security/CVE-2026-73072",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73074",
                        "url": "https://ubuntu.com/security/CVE-2026-73074",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73076",
                        "url": "https://ubuntu.com/security/CVE-2026-73076",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73077",
                        "url": "https://ubuntu.com/security/CVE-2026-73077",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73078",
                        "url": "https://ubuntu.com/security/CVE-2026-73078",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-28417",
                        "url": "https://ubuntu.com/security/CVE-2026-28417",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-02-27 22:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-42307",
                        "url": "https://ubuntu.com/security/CVE-2026-42307",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-08 23:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-73071",
                                "url": "https://ubuntu.com/security/CVE-2026-73071",
                                "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73072",
                                "url": "https://ubuntu.com/security/CVE-2026-73072",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73074",
                                "url": "https://ubuntu.com/security/CVE-2026-73074",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73076",
                                "url": "https://ubuntu.com/security/CVE-2026-73076",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73077",
                                "url": "https://ubuntu.com/security/CVE-2026-73077",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73078",
                                "url": "https://ubuntu.com/security/CVE-2026-73078",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-28417",
                                "url": "https://ubuntu.com/security/CVE-2026-28417",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-02-27 22:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-42307",
                                "url": "https://ubuntu.com/security/CVE-2026-42307",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-08 23:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Use-after-free on json decode error.",
                            "    - debian/patches/CVE-2026-73071.patch: Report the position from the",
                            "      current reader in src/json.c.",
                            "    - CVE-2026-73071",
                            "  * SECURITY UPDATE: Heap buffer overflow in set_sofo().",
                            "    - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in",
                            "      src/spellfile.c.",
                            "    - CVE-2026-73072",
                            "  * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.",
                            "    - debian/patches/CVE-2026-73074.patch: Verify that the number of text",
                            "      properties falls within the limit in src/errors.h and src/textprop.c.",
                            "    - CVE-2026-73074",
                            "  * SECURITY UPDATE: Code execution via VimballRecord file.",
                            "    - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix",
                            "      broken directory deletion code, and refactor code in",
                            "      runtime/autoload/vimball.vim",
                            "    - CVE-2026-73076",
                            "  * SECURITY UPDATE: Arbitrary code execution via keyword lookup.",
                            "    - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands",
                            "      using single quotes, for sh/zsh pass the argument as a separate list",
                            "      item to term_start()/system() in runtime/ftplugin/ps1.vim, ../sh.vim,",
                            "      and ../zsh.vim.",
                            "    - CVE-2026-73077",
                            "  * SECURITY UPDATE: Code injection in netrw via bookmarks.",
                            "    - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in",
                            "      runtime/pack/dist/opt/netrw/autoload/netrw.vim.",
                            "    - CVE-2026-73078",
                            "  * debian/patches/CVE-2026-28417.patch: Add test cases.",
                            "  * debian/patches/CVE-2026-42307.patch: Refresh to align with CVE-2026-28417",
                            ""
                        ],
                        "package": "vim",
                        "version": "2:9.1.2141-1ubuntu4.8",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 12:55:02 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [
            {
                "name": "linux-headers-7.0.0-30",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": null
                },
                "to_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-64531",
                        "url": "https://ubuntu.com/security/CVE-2026-64531",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-27 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-46331",
                        "url": "https://ubuntu.com/security/CVE-2026-46331",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-16 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53212",
                        "url": "https://ubuntu.com/security/CVE-2026-53212",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53359",
                        "url": "https://ubuntu.com/security/CVE-2026-53359",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-04 12:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53131",
                        "url": "https://ubuntu.com/security/CVE-2026-53131",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53151",
                        "url": "https://ubuntu.com/security/CVE-2026-53151",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53175",
                        "url": "https://ubuntu.com/security/CVE-2026-53175",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53176",
                        "url": "https://ubuntu.com/security/CVE-2026-53176",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53186",
                        "url": "https://ubuntu.com/security/CVE-2026-53186",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53215",
                        "url": "https://ubuntu.com/security/CVE-2026-53215",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53216",
                        "url": "https://ubuntu.com/security/CVE-2026-53216",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53221",
                        "url": "https://ubuntu.com/security/CVE-2026-53221",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53224",
                        "url": "https://ubuntu.com/security/CVE-2026-53224",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53225",
                        "url": "https://ubuntu.com/security/CVE-2026-53225",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                        "cve_priority": "negligible",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53228",
                        "url": "https://ubuntu.com/security/CVE-2026-53228",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-52924",
                        "url": "https://ubuntu.com/security/CVE-2026-52924",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-24 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53246",
                        "url": "https://ubuntu.com/security/CVE-2026-53246",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53247",
                        "url": "https://ubuntu.com/security/CVE-2026-53247",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53260",
                        "url": "https://ubuntu.com/security/CVE-2026-53260",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2162185,
                    2160781,
                    1786013,
                    2158267
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-64531",
                                "url": "https://ubuntu.com/security/CVE-2026-64531",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-27 08:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)",
                            "",
                            "  * CVE-2026-64531",
                            "    - net: openvswitch: reject oversized nested action attrs",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162185
                        ],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:29 +0200"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-46331",
                                "url": "https://ubuntu.com/security/CVE-2026-46331",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-16 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53212",
                                "url": "https://ubuntu.com/security/CVE-2026-53212",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53359",
                                "url": "https://ubuntu.com/security/CVE-2026-53359",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-04 12:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53131",
                                "url": "https://ubuntu.com/security/CVE-2026-53131",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53151",
                                "url": "https://ubuntu.com/security/CVE-2026-53151",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53175",
                                "url": "https://ubuntu.com/security/CVE-2026-53175",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53176",
                                "url": "https://ubuntu.com/security/CVE-2026-53176",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53186",
                                "url": "https://ubuntu.com/security/CVE-2026-53186",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53215",
                                "url": "https://ubuntu.com/security/CVE-2026-53215",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53216",
                                "url": "https://ubuntu.com/security/CVE-2026-53216",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53221",
                                "url": "https://ubuntu.com/security/CVE-2026-53221",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53224",
                                "url": "https://ubuntu.com/security/CVE-2026-53224",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53225",
                                "url": "https://ubuntu.com/security/CVE-2026-53225",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                                "cve_priority": "negligible",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53228",
                                "url": "https://ubuntu.com/security/CVE-2026-53228",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-52924",
                                "url": "https://ubuntu.com/security/CVE-2026-52924",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-24 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53246",
                                "url": "https://ubuntu.com/security/CVE-2026-53246",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53247",
                                "url": "https://ubuntu.com/security/CVE-2026-53247",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53260",
                                "url": "https://ubuntu.com/security/CVE-2026-53260",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)",
                            "",
                            "  * Packaging resync (LP: #1786013)",
                            "    - [Packaging] update annotations scripts",
                            "",
                            "  * CVE-2026-46331",
                            "    - net/sched: fix pedit partial COW leading to page cache corruption",
                            "",
                            "  * CVE-2026-53212",
                            "    - netfilter: nft_tunnel: fix use-after-free on object destroy",
                            "",
                            "  * CVE-2026-53359",
                            "    - KVM: x86: Fix shadow paging use-after-free due to unexpected role",
                            "",
                            "  * CVE-2026-53131",
                            "    - netfilter: require Ethernet MAC header before using eth_hdr()",
                            "",
                            "  * CVE-2026-53151",
                            "    - rxrpc: Fix the ACK parser to extract the SACK table for parsing",
                            "",
                            "  * CVE-2026-53175",
                            "    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
                            "",
                            "  * CVE-2026-53176",
                            "    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
                            "",
                            "  * CVE-2026-53186",
                            "    - RDMA/srp: bound SRP_RSP sense copy by the received length",
                            "",
                            "  * CVE-2026-53215",
                            "    - net: mvpp2: refill RX buffers before XDP or skb use",
                            "",
                            "  * CVE-2026-53216",
                            "    - net: mvpp2: limit XDP frame size to the RX buffer",
                            "",
                            "  * CVE-2026-53221",
                            "    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
                            "",
                            "  * CVE-2026-53224",
                            "    - sctp: validate embedded INIT chunk and address list lengths in cookie",
                            "",
                            "  * CVE-2026-53225",
                            "    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
                            "",
                            "  * CVE-2026-53228",
                            "    - ipv6: sit: reload inner IPv6 header after GSO offloads",
                            "",
                            "  * CVE-2026-52924",
                            "    - sctp: purge outqueue on stale COOKIE-ECHO handling",
                            "",
                            "  * CVE-2026-53246",
                            "    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
                            "",
                            "  * CVE-2026-53247",
                            "    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
                            "",
                            "  * CVE-2026-53260",
                            "    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
                            "",
                            "  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)",
                            "    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-29.29",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2160781,
                            1786013,
                            2158267
                        ],
                        "author": "Manuel Diewald <manuel.diewald@canonical.com>",
                        "date": "Fri, 17 Jul 2026 18:57:53 +0200"
                    }
                ],
                "notes": "linux-headers-7.0.0-30 version '7.0.0-30.30' (source package linux version '7.0.0-30.30') was added. linux-headers-7.0.0-30 version '7.0.0-30.30' has the same source package name, linux, as removed package linux-headers-7.0.0-28. As such we can use the source package version of the removed package, '7.0.0-28.28', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.",
                "is_version_downgrade": false
            },
            {
                "name": "linux-headers-7.0.0-30-generic",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": null
                },
                "to_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-64531",
                        "url": "https://ubuntu.com/security/CVE-2026-64531",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-27 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-46331",
                        "url": "https://ubuntu.com/security/CVE-2026-46331",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-16 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53212",
                        "url": "https://ubuntu.com/security/CVE-2026-53212",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53359",
                        "url": "https://ubuntu.com/security/CVE-2026-53359",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-04 12:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53131",
                        "url": "https://ubuntu.com/security/CVE-2026-53131",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53151",
                        "url": "https://ubuntu.com/security/CVE-2026-53151",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53175",
                        "url": "https://ubuntu.com/security/CVE-2026-53175",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53176",
                        "url": "https://ubuntu.com/security/CVE-2026-53176",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53186",
                        "url": "https://ubuntu.com/security/CVE-2026-53186",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53215",
                        "url": "https://ubuntu.com/security/CVE-2026-53215",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53216",
                        "url": "https://ubuntu.com/security/CVE-2026-53216",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53221",
                        "url": "https://ubuntu.com/security/CVE-2026-53221",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53224",
                        "url": "https://ubuntu.com/security/CVE-2026-53224",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53225",
                        "url": "https://ubuntu.com/security/CVE-2026-53225",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                        "cve_priority": "negligible",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53228",
                        "url": "https://ubuntu.com/security/CVE-2026-53228",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-52924",
                        "url": "https://ubuntu.com/security/CVE-2026-52924",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-24 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53246",
                        "url": "https://ubuntu.com/security/CVE-2026-53246",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53247",
                        "url": "https://ubuntu.com/security/CVE-2026-53247",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53260",
                        "url": "https://ubuntu.com/security/CVE-2026-53260",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2162185,
                    2160781,
                    1786013,
                    2158267
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-64531",
                                "url": "https://ubuntu.com/security/CVE-2026-64531",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-27 08:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)",
                            "",
                            "  * CVE-2026-64531",
                            "    - net: openvswitch: reject oversized nested action attrs",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162185
                        ],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:29 +0200"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-46331",
                                "url": "https://ubuntu.com/security/CVE-2026-46331",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-16 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53212",
                                "url": "https://ubuntu.com/security/CVE-2026-53212",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53359",
                                "url": "https://ubuntu.com/security/CVE-2026-53359",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-04 12:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53131",
                                "url": "https://ubuntu.com/security/CVE-2026-53131",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53151",
                                "url": "https://ubuntu.com/security/CVE-2026-53151",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53175",
                                "url": "https://ubuntu.com/security/CVE-2026-53175",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53176",
                                "url": "https://ubuntu.com/security/CVE-2026-53176",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53186",
                                "url": "https://ubuntu.com/security/CVE-2026-53186",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53215",
                                "url": "https://ubuntu.com/security/CVE-2026-53215",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53216",
                                "url": "https://ubuntu.com/security/CVE-2026-53216",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53221",
                                "url": "https://ubuntu.com/security/CVE-2026-53221",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53224",
                                "url": "https://ubuntu.com/security/CVE-2026-53224",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53225",
                                "url": "https://ubuntu.com/security/CVE-2026-53225",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                                "cve_priority": "negligible",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53228",
                                "url": "https://ubuntu.com/security/CVE-2026-53228",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-52924",
                                "url": "https://ubuntu.com/security/CVE-2026-52924",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-24 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53246",
                                "url": "https://ubuntu.com/security/CVE-2026-53246",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53247",
                                "url": "https://ubuntu.com/security/CVE-2026-53247",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53260",
                                "url": "https://ubuntu.com/security/CVE-2026-53260",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)",
                            "",
                            "  * Packaging resync (LP: #1786013)",
                            "    - [Packaging] update annotations scripts",
                            "",
                            "  * CVE-2026-46331",
                            "    - net/sched: fix pedit partial COW leading to page cache corruption",
                            "",
                            "  * CVE-2026-53212",
                            "    - netfilter: nft_tunnel: fix use-after-free on object destroy",
                            "",
                            "  * CVE-2026-53359",
                            "    - KVM: x86: Fix shadow paging use-after-free due to unexpected role",
                            "",
                            "  * CVE-2026-53131",
                            "    - netfilter: require Ethernet MAC header before using eth_hdr()",
                            "",
                            "  * CVE-2026-53151",
                            "    - rxrpc: Fix the ACK parser to extract the SACK table for parsing",
                            "",
                            "  * CVE-2026-53175",
                            "    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
                            "",
                            "  * CVE-2026-53176",
                            "    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
                            "",
                            "  * CVE-2026-53186",
                            "    - RDMA/srp: bound SRP_RSP sense copy by the received length",
                            "",
                            "  * CVE-2026-53215",
                            "    - net: mvpp2: refill RX buffers before XDP or skb use",
                            "",
                            "  * CVE-2026-53216",
                            "    - net: mvpp2: limit XDP frame size to the RX buffer",
                            "",
                            "  * CVE-2026-53221",
                            "    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
                            "",
                            "  * CVE-2026-53224",
                            "    - sctp: validate embedded INIT chunk and address list lengths in cookie",
                            "",
                            "  * CVE-2026-53225",
                            "    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
                            "",
                            "  * CVE-2026-53228",
                            "    - ipv6: sit: reload inner IPv6 header after GSO offloads",
                            "",
                            "  * CVE-2026-52924",
                            "    - sctp: purge outqueue on stale COOKIE-ECHO handling",
                            "",
                            "  * CVE-2026-53246",
                            "    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
                            "",
                            "  * CVE-2026-53247",
                            "    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
                            "",
                            "  * CVE-2026-53260",
                            "    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
                            "",
                            "  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)",
                            "    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-29.29",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2160781,
                            1786013,
                            2158267
                        ],
                        "author": "Manuel Diewald <manuel.diewald@canonical.com>",
                        "date": "Fri, 17 Jul 2026 18:57:53 +0200"
                    }
                ],
                "notes": "linux-headers-7.0.0-30-generic version '7.0.0-30.30' (source package linux version '7.0.0-30.30') was added. linux-headers-7.0.0-30-generic version '7.0.0-30.30' has the same source package name, linux, as removed package linux-headers-7.0.0-28. As such we can use the source package version of the removed package, '7.0.0-28.28', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.",
                "is_version_downgrade": false
            },
            {
                "name": "linux-image-7.0.0-30-generic",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": null
                },
                "to_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-64531",
                        "url": "https://ubuntu.com/security/CVE-2026-64531",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-27 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-46331",
                        "url": "https://ubuntu.com/security/CVE-2026-46331",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-16 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53212",
                        "url": "https://ubuntu.com/security/CVE-2026-53212",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53359",
                        "url": "https://ubuntu.com/security/CVE-2026-53359",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-04 12:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53131",
                        "url": "https://ubuntu.com/security/CVE-2026-53131",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53151",
                        "url": "https://ubuntu.com/security/CVE-2026-53151",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53175",
                        "url": "https://ubuntu.com/security/CVE-2026-53175",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53176",
                        "url": "https://ubuntu.com/security/CVE-2026-53176",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53186",
                        "url": "https://ubuntu.com/security/CVE-2026-53186",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53215",
                        "url": "https://ubuntu.com/security/CVE-2026-53215",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53216",
                        "url": "https://ubuntu.com/security/CVE-2026-53216",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53221",
                        "url": "https://ubuntu.com/security/CVE-2026-53221",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53224",
                        "url": "https://ubuntu.com/security/CVE-2026-53224",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53225",
                        "url": "https://ubuntu.com/security/CVE-2026-53225",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                        "cve_priority": "negligible",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53228",
                        "url": "https://ubuntu.com/security/CVE-2026-53228",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-52924",
                        "url": "https://ubuntu.com/security/CVE-2026-52924",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-24 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53246",
                        "url": "https://ubuntu.com/security/CVE-2026-53246",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53247",
                        "url": "https://ubuntu.com/security/CVE-2026-53247",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53260",
                        "url": "https://ubuntu.com/security/CVE-2026-53260",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2162185,
                    2160781,
                    1786013,
                    2158267
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-64531",
                                "url": "https://ubuntu.com/security/CVE-2026-64531",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-27 08:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)",
                            "",
                            "  * CVE-2026-64531",
                            "    - net: openvswitch: reject oversized nested action attrs",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162185
                        ],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:29 +0200"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-46331",
                                "url": "https://ubuntu.com/security/CVE-2026-46331",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-16 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53212",
                                "url": "https://ubuntu.com/security/CVE-2026-53212",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53359",
                                "url": "https://ubuntu.com/security/CVE-2026-53359",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-04 12:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53131",
                                "url": "https://ubuntu.com/security/CVE-2026-53131",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53151",
                                "url": "https://ubuntu.com/security/CVE-2026-53151",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53175",
                                "url": "https://ubuntu.com/security/CVE-2026-53175",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53176",
                                "url": "https://ubuntu.com/security/CVE-2026-53176",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53186",
                                "url": "https://ubuntu.com/security/CVE-2026-53186",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53215",
                                "url": "https://ubuntu.com/security/CVE-2026-53215",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53216",
                                "url": "https://ubuntu.com/security/CVE-2026-53216",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53221",
                                "url": "https://ubuntu.com/security/CVE-2026-53221",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53224",
                                "url": "https://ubuntu.com/security/CVE-2026-53224",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53225",
                                "url": "https://ubuntu.com/security/CVE-2026-53225",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                                "cve_priority": "negligible",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53228",
                                "url": "https://ubuntu.com/security/CVE-2026-53228",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-52924",
                                "url": "https://ubuntu.com/security/CVE-2026-52924",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-24 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53246",
                                "url": "https://ubuntu.com/security/CVE-2026-53246",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53247",
                                "url": "https://ubuntu.com/security/CVE-2026-53247",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53260",
                                "url": "https://ubuntu.com/security/CVE-2026-53260",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)",
                            "",
                            "  * Packaging resync (LP: #1786013)",
                            "    - [Packaging] update annotations scripts",
                            "",
                            "  * CVE-2026-46331",
                            "    - net/sched: fix pedit partial COW leading to page cache corruption",
                            "",
                            "  * CVE-2026-53212",
                            "    - netfilter: nft_tunnel: fix use-after-free on object destroy",
                            "",
                            "  * CVE-2026-53359",
                            "    - KVM: x86: Fix shadow paging use-after-free due to unexpected role",
                            "",
                            "  * CVE-2026-53131",
                            "    - netfilter: require Ethernet MAC header before using eth_hdr()",
                            "",
                            "  * CVE-2026-53151",
                            "    - rxrpc: Fix the ACK parser to extract the SACK table for parsing",
                            "",
                            "  * CVE-2026-53175",
                            "    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
                            "",
                            "  * CVE-2026-53176",
                            "    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
                            "",
                            "  * CVE-2026-53186",
                            "    - RDMA/srp: bound SRP_RSP sense copy by the received length",
                            "",
                            "  * CVE-2026-53215",
                            "    - net: mvpp2: refill RX buffers before XDP or skb use",
                            "",
                            "  * CVE-2026-53216",
                            "    - net: mvpp2: limit XDP frame size to the RX buffer",
                            "",
                            "  * CVE-2026-53221",
                            "    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
                            "",
                            "  * CVE-2026-53224",
                            "    - sctp: validate embedded INIT chunk and address list lengths in cookie",
                            "",
                            "  * CVE-2026-53225",
                            "    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
                            "",
                            "  * CVE-2026-53228",
                            "    - ipv6: sit: reload inner IPv6 header after GSO offloads",
                            "",
                            "  * CVE-2026-52924",
                            "    - sctp: purge outqueue on stale COOKIE-ECHO handling",
                            "",
                            "  * CVE-2026-53246",
                            "    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
                            "",
                            "  * CVE-2026-53247",
                            "    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
                            "",
                            "  * CVE-2026-53260",
                            "    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
                            "",
                            "  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)",
                            "    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-29.29",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2160781,
                            1786013,
                            2158267
                        ],
                        "author": "Manuel Diewald <manuel.diewald@canonical.com>",
                        "date": "Fri, 17 Jul 2026 18:57:53 +0200"
                    }
                ],
                "notes": "linux-image-7.0.0-30-generic version '7.0.0-30.30' (source package linux version '7.0.0-30.30') was added. linux-image-7.0.0-30-generic version '7.0.0-30.30' has the same source package name, linux, as removed package linux-headers-7.0.0-28. As such we can use the source package version of the removed package, '7.0.0-28.28', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.",
                "is_version_downgrade": false
            },
            {
                "name": "linux-modules-7.0.0-30-generic",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": null
                },
                "to_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-64531",
                        "url": "https://ubuntu.com/security/CVE-2026-64531",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-27 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-46331",
                        "url": "https://ubuntu.com/security/CVE-2026-46331",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-16 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53212",
                        "url": "https://ubuntu.com/security/CVE-2026-53212",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53359",
                        "url": "https://ubuntu.com/security/CVE-2026-53359",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-04 12:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53131",
                        "url": "https://ubuntu.com/security/CVE-2026-53131",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53151",
                        "url": "https://ubuntu.com/security/CVE-2026-53151",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53175",
                        "url": "https://ubuntu.com/security/CVE-2026-53175",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53176",
                        "url": "https://ubuntu.com/security/CVE-2026-53176",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53186",
                        "url": "https://ubuntu.com/security/CVE-2026-53186",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53215",
                        "url": "https://ubuntu.com/security/CVE-2026-53215",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53216",
                        "url": "https://ubuntu.com/security/CVE-2026-53216",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53221",
                        "url": "https://ubuntu.com/security/CVE-2026-53221",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53224",
                        "url": "https://ubuntu.com/security/CVE-2026-53224",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53225",
                        "url": "https://ubuntu.com/security/CVE-2026-53225",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                        "cve_priority": "negligible",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53228",
                        "url": "https://ubuntu.com/security/CVE-2026-53228",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-52924",
                        "url": "https://ubuntu.com/security/CVE-2026-52924",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-24 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53246",
                        "url": "https://ubuntu.com/security/CVE-2026-53246",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53247",
                        "url": "https://ubuntu.com/security/CVE-2026-53247",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53260",
                        "url": "https://ubuntu.com/security/CVE-2026-53260",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2162185,
                    2160781,
                    1786013,
                    2158267
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-64531",
                                "url": "https://ubuntu.com/security/CVE-2026-64531",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-27 08:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)",
                            "",
                            "  * CVE-2026-64531",
                            "    - net: openvswitch: reject oversized nested action attrs",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162185
                        ],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:29 +0200"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-46331",
                                "url": "https://ubuntu.com/security/CVE-2026-46331",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-16 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53212",
                                "url": "https://ubuntu.com/security/CVE-2026-53212",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53359",
                                "url": "https://ubuntu.com/security/CVE-2026-53359",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-04 12:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53131",
                                "url": "https://ubuntu.com/security/CVE-2026-53131",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53151",
                                "url": "https://ubuntu.com/security/CVE-2026-53151",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53175",
                                "url": "https://ubuntu.com/security/CVE-2026-53175",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53176",
                                "url": "https://ubuntu.com/security/CVE-2026-53176",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53186",
                                "url": "https://ubuntu.com/security/CVE-2026-53186",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53215",
                                "url": "https://ubuntu.com/security/CVE-2026-53215",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53216",
                                "url": "https://ubuntu.com/security/CVE-2026-53216",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53221",
                                "url": "https://ubuntu.com/security/CVE-2026-53221",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53224",
                                "url": "https://ubuntu.com/security/CVE-2026-53224",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53225",
                                "url": "https://ubuntu.com/security/CVE-2026-53225",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                                "cve_priority": "negligible",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53228",
                                "url": "https://ubuntu.com/security/CVE-2026-53228",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-52924",
                                "url": "https://ubuntu.com/security/CVE-2026-52924",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-24 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53246",
                                "url": "https://ubuntu.com/security/CVE-2026-53246",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53247",
                                "url": "https://ubuntu.com/security/CVE-2026-53247",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53260",
                                "url": "https://ubuntu.com/security/CVE-2026-53260",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)",
                            "",
                            "  * Packaging resync (LP: #1786013)",
                            "    - [Packaging] update annotations scripts",
                            "",
                            "  * CVE-2026-46331",
                            "    - net/sched: fix pedit partial COW leading to page cache corruption",
                            "",
                            "  * CVE-2026-53212",
                            "    - netfilter: nft_tunnel: fix use-after-free on object destroy",
                            "",
                            "  * CVE-2026-53359",
                            "    - KVM: x86: Fix shadow paging use-after-free due to unexpected role",
                            "",
                            "  * CVE-2026-53131",
                            "    - netfilter: require Ethernet MAC header before using eth_hdr()",
                            "",
                            "  * CVE-2026-53151",
                            "    - rxrpc: Fix the ACK parser to extract the SACK table for parsing",
                            "",
                            "  * CVE-2026-53175",
                            "    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
                            "",
                            "  * CVE-2026-53176",
                            "    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
                            "",
                            "  * CVE-2026-53186",
                            "    - RDMA/srp: bound SRP_RSP sense copy by the received length",
                            "",
                            "  * CVE-2026-53215",
                            "    - net: mvpp2: refill RX buffers before XDP or skb use",
                            "",
                            "  * CVE-2026-53216",
                            "    - net: mvpp2: limit XDP frame size to the RX buffer",
                            "",
                            "  * CVE-2026-53221",
                            "    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
                            "",
                            "  * CVE-2026-53224",
                            "    - sctp: validate embedded INIT chunk and address list lengths in cookie",
                            "",
                            "  * CVE-2026-53225",
                            "    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
                            "",
                            "  * CVE-2026-53228",
                            "    - ipv6: sit: reload inner IPv6 header after GSO offloads",
                            "",
                            "  * CVE-2026-52924",
                            "    - sctp: purge outqueue on stale COOKIE-ECHO handling",
                            "",
                            "  * CVE-2026-53246",
                            "    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
                            "",
                            "  * CVE-2026-53247",
                            "    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
                            "",
                            "  * CVE-2026-53260",
                            "    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
                            "",
                            "  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)",
                            "    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-29.29",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2160781,
                            1786013,
                            2158267
                        ],
                        "author": "Manuel Diewald <manuel.diewald@canonical.com>",
                        "date": "Fri, 17 Jul 2026 18:57:53 +0200"
                    }
                ],
                "notes": "linux-modules-7.0.0-30-generic version '7.0.0-30.30' (source package linux version '7.0.0-30.30') was added. linux-modules-7.0.0-30-generic version '7.0.0-30.30' has the same source package name, linux, as removed package linux-headers-7.0.0-28. As such we can use the source package version of the removed package, '7.0.0-28.28', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.",
                "is_version_downgrade": false
            },
            {
                "name": "linux-tools-7.0.0-30",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": null
                },
                "to_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-64531",
                        "url": "https://ubuntu.com/security/CVE-2026-64531",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-27 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-46331",
                        "url": "https://ubuntu.com/security/CVE-2026-46331",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-16 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53212",
                        "url": "https://ubuntu.com/security/CVE-2026-53212",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53359",
                        "url": "https://ubuntu.com/security/CVE-2026-53359",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-04 12:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53131",
                        "url": "https://ubuntu.com/security/CVE-2026-53131",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53151",
                        "url": "https://ubuntu.com/security/CVE-2026-53151",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53175",
                        "url": "https://ubuntu.com/security/CVE-2026-53175",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53176",
                        "url": "https://ubuntu.com/security/CVE-2026-53176",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53186",
                        "url": "https://ubuntu.com/security/CVE-2026-53186",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53215",
                        "url": "https://ubuntu.com/security/CVE-2026-53215",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53216",
                        "url": "https://ubuntu.com/security/CVE-2026-53216",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53221",
                        "url": "https://ubuntu.com/security/CVE-2026-53221",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53224",
                        "url": "https://ubuntu.com/security/CVE-2026-53224",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53225",
                        "url": "https://ubuntu.com/security/CVE-2026-53225",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                        "cve_priority": "negligible",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53228",
                        "url": "https://ubuntu.com/security/CVE-2026-53228",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-52924",
                        "url": "https://ubuntu.com/security/CVE-2026-52924",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-24 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53246",
                        "url": "https://ubuntu.com/security/CVE-2026-53246",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53247",
                        "url": "https://ubuntu.com/security/CVE-2026-53247",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53260",
                        "url": "https://ubuntu.com/security/CVE-2026-53260",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2162185,
                    2160781,
                    1786013,
                    2158267
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-64531",
                                "url": "https://ubuntu.com/security/CVE-2026-64531",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-27 08:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)",
                            "",
                            "  * CVE-2026-64531",
                            "    - net: openvswitch: reject oversized nested action attrs",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162185
                        ],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:29 +0200"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-46331",
                                "url": "https://ubuntu.com/security/CVE-2026-46331",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-16 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53212",
                                "url": "https://ubuntu.com/security/CVE-2026-53212",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53359",
                                "url": "https://ubuntu.com/security/CVE-2026-53359",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-04 12:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53131",
                                "url": "https://ubuntu.com/security/CVE-2026-53131",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53151",
                                "url": "https://ubuntu.com/security/CVE-2026-53151",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53175",
                                "url": "https://ubuntu.com/security/CVE-2026-53175",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53176",
                                "url": "https://ubuntu.com/security/CVE-2026-53176",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53186",
                                "url": "https://ubuntu.com/security/CVE-2026-53186",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53215",
                                "url": "https://ubuntu.com/security/CVE-2026-53215",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53216",
                                "url": "https://ubuntu.com/security/CVE-2026-53216",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53221",
                                "url": "https://ubuntu.com/security/CVE-2026-53221",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53224",
                                "url": "https://ubuntu.com/security/CVE-2026-53224",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53225",
                                "url": "https://ubuntu.com/security/CVE-2026-53225",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                                "cve_priority": "negligible",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53228",
                                "url": "https://ubuntu.com/security/CVE-2026-53228",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-52924",
                                "url": "https://ubuntu.com/security/CVE-2026-52924",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-24 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53246",
                                "url": "https://ubuntu.com/security/CVE-2026-53246",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53247",
                                "url": "https://ubuntu.com/security/CVE-2026-53247",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53260",
                                "url": "https://ubuntu.com/security/CVE-2026-53260",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)",
                            "",
                            "  * Packaging resync (LP: #1786013)",
                            "    - [Packaging] update annotations scripts",
                            "",
                            "  * CVE-2026-46331",
                            "    - net/sched: fix pedit partial COW leading to page cache corruption",
                            "",
                            "  * CVE-2026-53212",
                            "    - netfilter: nft_tunnel: fix use-after-free on object destroy",
                            "",
                            "  * CVE-2026-53359",
                            "    - KVM: x86: Fix shadow paging use-after-free due to unexpected role",
                            "",
                            "  * CVE-2026-53131",
                            "    - netfilter: require Ethernet MAC header before using eth_hdr()",
                            "",
                            "  * CVE-2026-53151",
                            "    - rxrpc: Fix the ACK parser to extract the SACK table for parsing",
                            "",
                            "  * CVE-2026-53175",
                            "    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
                            "",
                            "  * CVE-2026-53176",
                            "    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
                            "",
                            "  * CVE-2026-53186",
                            "    - RDMA/srp: bound SRP_RSP sense copy by the received length",
                            "",
                            "  * CVE-2026-53215",
                            "    - net: mvpp2: refill RX buffers before XDP or skb use",
                            "",
                            "  * CVE-2026-53216",
                            "    - net: mvpp2: limit XDP frame size to the RX buffer",
                            "",
                            "  * CVE-2026-53221",
                            "    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
                            "",
                            "  * CVE-2026-53224",
                            "    - sctp: validate embedded INIT chunk and address list lengths in cookie",
                            "",
                            "  * CVE-2026-53225",
                            "    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
                            "",
                            "  * CVE-2026-53228",
                            "    - ipv6: sit: reload inner IPv6 header after GSO offloads",
                            "",
                            "  * CVE-2026-52924",
                            "    - sctp: purge outqueue on stale COOKIE-ECHO handling",
                            "",
                            "  * CVE-2026-53246",
                            "    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
                            "",
                            "  * CVE-2026-53247",
                            "    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
                            "",
                            "  * CVE-2026-53260",
                            "    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
                            "",
                            "  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)",
                            "    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-29.29",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2160781,
                            1786013,
                            2158267
                        ],
                        "author": "Manuel Diewald <manuel.diewald@canonical.com>",
                        "date": "Fri, 17 Jul 2026 18:57:53 +0200"
                    }
                ],
                "notes": "linux-tools-7.0.0-30 version '7.0.0-30.30' (source package linux version '7.0.0-30.30') was added. linux-tools-7.0.0-30 version '7.0.0-30.30' has the same source package name, linux, as removed package linux-headers-7.0.0-28. As such we can use the source package version of the removed package, '7.0.0-28.28', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.",
                "is_version_downgrade": false
            },
            {
                "name": "linux-tools-7.0.0-30-generic",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": null
                },
                "to_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-30.30",
                    "version": "7.0.0-30.30"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-64531",
                        "url": "https://ubuntu.com/security/CVE-2026-64531",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-27 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-46331",
                        "url": "https://ubuntu.com/security/CVE-2026-46331",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-16 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53212",
                        "url": "https://ubuntu.com/security/CVE-2026-53212",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53359",
                        "url": "https://ubuntu.com/security/CVE-2026-53359",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-07-04 12:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53131",
                        "url": "https://ubuntu.com/security/CVE-2026-53131",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53151",
                        "url": "https://ubuntu.com/security/CVE-2026-53151",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53175",
                        "url": "https://ubuntu.com/security/CVE-2026-53175",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53176",
                        "url": "https://ubuntu.com/security/CVE-2026-53176",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53186",
                        "url": "https://ubuntu.com/security/CVE-2026-53186",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53215",
                        "url": "https://ubuntu.com/security/CVE-2026-53215",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53216",
                        "url": "https://ubuntu.com/security/CVE-2026-53216",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53221",
                        "url": "https://ubuntu.com/security/CVE-2026-53221",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53224",
                        "url": "https://ubuntu.com/security/CVE-2026-53224",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53225",
                        "url": "https://ubuntu.com/security/CVE-2026-53225",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                        "cve_priority": "negligible",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53228",
                        "url": "https://ubuntu.com/security/CVE-2026-53228",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-52924",
                        "url": "https://ubuntu.com/security/CVE-2026-52924",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-06-24 08:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53246",
                        "url": "https://ubuntu.com/security/CVE-2026-53246",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53247",
                        "url": "https://ubuntu.com/security/CVE-2026-53247",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-53260",
                        "url": "https://ubuntu.com/security/CVE-2026-53260",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-06-25 09:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2162185,
                    2160781,
                    1786013,
                    2158267
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-64531",
                                "url": "https://ubuntu.com/security/CVE-2026-64531",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: reject oversized nested action attrs  Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX.  An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.  Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.  Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-27 08:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)",
                            "",
                            "  * CVE-2026-64531",
                            "    - net: openvswitch: reject oversized nested action attrs",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-30.30",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2162185
                        ],
                        "author": "Edoardo Canepa <edoardo.canepa@canonical.com>",
                        "date": "Fri, 31 Jul 2026 18:27:29 +0200"
                    },
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-46331",
                                "url": "https://ubuntu.com/security/CVE-2026-46331",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: fix pedit partial COW leading to page cache corruption  tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.  Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-16 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53212",
                                "url": "https://ubuntu.com/security/CVE-2026-53212",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_tunnel: fix use-after-free on object destroy  nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.  Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53359",
                                "url": "https://ubuntu.com/security/CVE-2026-53359",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix shadow paging use-after-free due to unexpected role  Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot.  The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.  A similar hole however remains if the modified PDE points to a non-leaf page.  In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0.  However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page.  The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk.  But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels).  It therefore fails to remove the recorded entry.  When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed.  Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-07-04 12:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53131",
                                "url": "https://ubuntu.com/security/CVE-2026-53131",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: require Ethernet MAC header before using eth_hdr()  `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`.  Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53151",
                                "url": "https://ubuntu.com/security/CVE-2026-53151",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix the ACK parser to extract the SACK table for parsing  Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse  AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.  Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.  Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53175",
                                "url": "https://ubuntu.com/security/CVE-2026-53175",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush  On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.  fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.  Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53176",
                                "url": "https://ubuntu.com/security/CVE-2026-53176",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN  In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative.  isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path.  Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53186",
                                "url": "https://ubuntu.com/security/CVE-2026-53186",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: bound SRP_RSP sense copy by the received length  srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.  A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.  Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53215",
                                "url": "https://ubuntu.com/security/CVE-2026-53215",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: refill RX buffers before XDP or skb use  The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer.  mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring.  Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53216",
                                "url": "https://ubuntu.com/security/CVE-2026-53216",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: mvpp2: limit XDP frame size to the RX buffer  mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size.  XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks.  Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53221",
                                "url": "https://ubuntu.com/security/CVE-2026-53221",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()  In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:  - Tunnels matching the packet's local address, with any remote address   wildcard remote).  - Tunnels matching the packet's remote address, with any local address   (wildcard local).  However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.  The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53224",
                                "url": "https://ubuntu.com/security/CVE-2026-53224",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address list lengths in cookie  sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header.  A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk).  Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads.  In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.  Fix this by:  - requiring the embedded INIT chunk length to be at least sizeof(struct   sctp_init_chunk); - validating that the INIT chunk and raw address list together fit   within the cookie payload; - verifying sufficient data exists for each address parameter header and   payload before parsing it.  Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53225",
                                "url": "https://ubuntu.com/security/CVE-2026-53225",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: fix uninit-value in __sctp_rcv_asconf_lookup()  __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length.  An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter.  Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter.  The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",
                                "cve_priority": "negligible",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53228",
                                "url": "https://ubuntu.com/security/CVE-2026-53228",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: sit: reload inner IPv6 header after GSO offloads  ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().  For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.  If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.  Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-52924",
                                "url": "https://ubuntu.com/security/CVE-2026-52924",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: purge outqueue on stale COOKIE-ECHO handling  sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.  However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.  During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.  Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().  This results in crashes such as (reported by Yuqi):    BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140   Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312   CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted      7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)    sctp_sched_fcfs_dequeue+0x13a/0x140    sctp_outq_flush+0x1603/0x33e0    sctp_do_sm+0x31c9/0x5d30    sctp_assoc_bh_rcv+0x392/0x6f0    sctp_inq_push+0x1db/0x270    sctp_rcv+0x138d/0x3c10  Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.  Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-06-24 08:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53246",
                                "url": "https://ubuntu.com/security/CVE-2026-53246",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing  When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params().  However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies).  Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53247",
                                "url": "https://ubuntu.com/security/CVE-2026-53247",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown  mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-53260",
                                "url": "https://ubuntu.com/security/CVE-2026-53260",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().  syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop().  The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash.  Moreover, reqsk_timer_handler() calls another reqsk_put() after that.  This indicates that the reqsk was missing both refcnts for ehash and the timer itself.  Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close().  Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested().  Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine.  The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert().  [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G             L     syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace:  <TASK>  __refcount_sub_and_test include/linux/refcount.h:400 [inline]  __refcount_dec_and_test include/linux/refcount.h:432 [inline]  refcount_dec_and_test include/linux/refcount.h:450 [inline]  reqsk_put include/net/request_sock.h:136 [inline]  __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007  reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137  call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748  expire_timers kernel/time/timer.c:1799 [inline]  __run_timers kernel/time/timer.c:2374 [inline]  __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386  run_timer_base kernel/time/timer.c:2395 [inline]  run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403  handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622  __do_softirq kernel/softirq.c:656 [inline]  run_ktimerd+0x69/0x100 kernel/softirq.c:1151  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160  kthread+0x388/0x470 kernel/kthread.c:436  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-06-25 09:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)",
                            "",
                            "  * Packaging resync (LP: #1786013)",
                            "    - [Packaging] update annotations scripts",
                            "",
                            "  * CVE-2026-46331",
                            "    - net/sched: fix pedit partial COW leading to page cache corruption",
                            "",
                            "  * CVE-2026-53212",
                            "    - netfilter: nft_tunnel: fix use-after-free on object destroy",
                            "",
                            "  * CVE-2026-53359",
                            "    - KVM: x86: Fix shadow paging use-after-free due to unexpected role",
                            "",
                            "  * CVE-2026-53131",
                            "    - netfilter: require Ethernet MAC header before using eth_hdr()",
                            "",
                            "  * CVE-2026-53151",
                            "    - rxrpc: Fix the ACK parser to extract the SACK table for parsing",
                            "",
                            "  * CVE-2026-53175",
                            "    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
                            "",
                            "  * CVE-2026-53176",
                            "    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
                            "",
                            "  * CVE-2026-53186",
                            "    - RDMA/srp: bound SRP_RSP sense copy by the received length",
                            "",
                            "  * CVE-2026-53215",
                            "    - net: mvpp2: refill RX buffers before XDP or skb use",
                            "",
                            "  * CVE-2026-53216",
                            "    - net: mvpp2: limit XDP frame size to the RX buffer",
                            "",
                            "  * CVE-2026-53221",
                            "    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
                            "",
                            "  * CVE-2026-53224",
                            "    - sctp: validate embedded INIT chunk and address list lengths in cookie",
                            "",
                            "  * CVE-2026-53225",
                            "    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
                            "",
                            "  * CVE-2026-53228",
                            "    - ipv6: sit: reload inner IPv6 header after GSO offloads",
                            "",
                            "  * CVE-2026-52924",
                            "    - sctp: purge outqueue on stale COOKIE-ECHO handling",
                            "",
                            "  * CVE-2026-53246",
                            "    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
                            "",
                            "  * CVE-2026-53247",
                            "    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
                            "",
                            "  * CVE-2026-53260",
                            "    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
                            "",
                            "  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)",
                            "    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages",
                            ""
                        ],
                        "package": "linux",
                        "version": "7.0.0-29.29",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2160781,
                            1786013,
                            2158267
                        ],
                        "author": "Manuel Diewald <manuel.diewald@canonical.com>",
                        "date": "Fri, 17 Jul 2026 18:57:53 +0200"
                    }
                ],
                "notes": "linux-tools-7.0.0-30-generic version '7.0.0-30.30' (source package linux version '7.0.0-30.30') was added. linux-tools-7.0.0-30-generic version '7.0.0-30.30' has the same source package name, linux, as removed package linux-headers-7.0.0-28. As such we can use the source package version of the removed package, '7.0.0-28.28', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.",
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "removed": {
        "deb": [
            {
                "name": "linux-headers-7.0.0-28",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": null
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-headers-7.0.0-28-generic",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": null
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-image-7.0.0-28-generic",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": null
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-modules-7.0.0-28-generic",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": null
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-tools-7.0.0-28",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": null
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-tools-7.0.0-28-generic",
                "from_version": {
                    "source_package_name": "linux",
                    "source_package_version": "7.0.0-28.28",
                    "version": "7.0.0-28.28"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": null
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 26.04 resolute image from release image serial 20260731 to 20260823",
    "from_series": "resolute",
    "to_series": "resolute",
    "from_serial": "20260731",
    "to_serial": "20260823",
    "from_manifest_filename": "release_manifest.previous",
    "to_manifest_filename": "manifest.current"
}