{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-headers-5.15.0-1106-kvm", "linux-image-5.15.0-1106-kvm", "linux-kvm-headers-5.15.0-1106", "linux-modules-5.15.0-1106-kvm" ], "removed": [ "linux-headers-5.15.0-1105-kvm", "linux-image-5.15.0-1105-kvm", "linux-kvm-headers-5.15.0-1105", "linux-modules-5.15.0-1105-kvm" ], "diff": [ "libnss-systemd", "libpam-systemd", "libpng16-16", "libsystemd0", "libudev1", "linux-headers-kvm", "linux-image-kvm", "linux-kvm", "systemd", "systemd-sysv", "systemd-timesyncd", "udev" ] } }, "diff": { "deb": [ { "name": "libnss-systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpng16-16", "from_version": { "source_package_name": "libpng1.6", "source_package_version": "1.6.37-3ubuntu0.5", "version": "1.6.37-3ubuntu0.5" }, "to_version": { "source_package_name": "libpng1.6", "source_package_version": "1.6.37-3ubuntu0.6", "version": "1.6.37-3ubuntu0.6" }, "cves": [ { "cve": "CVE-2026-40930", "url": "https://ubuntu.com/security/CVE-2026-40930", "cve_description": "LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-06-04 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-40930", "url": "https://ubuntu.com/security/CVE-2026-40930", "cve_description": "LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-06-04 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Interpretation conflict in APNG parser", " paths.", " - debian/patches/CVE-2026-40930.patch: Restructure the trailing-fdAT", " path in pngpread.c", " - debian/patches/CVE-2026-40930-post1.patch: Fix hardcoded length in", " png_ensure_sequence_number in pngpread.c", " - CVE-2026-40930", "" ], "package": "libpng1.6", "version": "1.6.37-3ubuntu0.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Thu, 13 Aug 2026 10:20:26 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsystemd0", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libudev1", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-kvm", "from_version": { "source_package_name": "linux-meta-kvm", "source_package_version": "5.15.0.1105.101", "version": "5.15.0.1105.101" }, "to_version": { "source_package_name": "linux-meta-kvm", "source_package_version": "5.15.0.1106.102", "version": "5.15.0.1106.102" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump ABI 5.15.0-1106", "" ], "package": "linux-meta-kvm", "version": "5.15.0.1106.102", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Manuel Diewald ", "date": "Tue, 11 Aug 2026 16:31:40 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-kvm", "from_version": { "source_package_name": "linux-meta-kvm", "source_package_version": "5.15.0.1105.101", "version": "5.15.0.1105.101" }, "to_version": { "source_package_name": "linux-meta-kvm", "source_package_version": "5.15.0.1106.102", "version": "5.15.0.1106.102" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump ABI 5.15.0-1106", "" ], "package": "linux-meta-kvm", "version": "5.15.0.1106.102", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Manuel Diewald ", "date": "Tue, 11 Aug 2026 16:31:40 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-kvm", "from_version": { "source_package_name": "linux-meta-kvm", "source_package_version": "5.15.0.1105.101", "version": "5.15.0.1105.101" }, "to_version": { "source_package_name": "linux-meta-kvm", "source_package_version": "5.15.0.1106.102", "version": "5.15.0.1106.102" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump ABI 5.15.0-1106", "" ], "package": "linux-meta-kvm", "version": "5.15.0.1106.102", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Manuel Diewald ", "date": "Tue, 11 Aug 2026 16:31:40 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-sysv", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-timesyncd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "udev", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-headers-5.15.0-1106-kvm", "from_version": { "source_package_name": "linux-kvm", "source_package_version": "5.15.0-1105.110", "version": null }, "to_version": { "source_package_name": "linux-kvm", "source_package_version": "5.15.0-1106.111", "version": "5.15.0-1106.111" }, "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162280, 2163031, 2162294 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux-kvm: 5.15.0-1106.111 -proposed tracker (LP: #2162280)", "", " [ Ubuntu: 5.15.0-190.200 ]", "", " * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)", " * CVE-2026-53246", " - sctp: delete the nested flexible array peer_init", "", " [ Ubuntu: 5.15.0-188.198 ]", "", " * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux-kvm", "version": "5.15.0-1106.111", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2162280, 2163031, 2162294 ], "author": "Manuel Diewald ", "date": "Tue, 11 Aug 2026 16:31:15 +0200" } ], "notes": "linux-headers-5.15.0-1106-kvm version '5.15.0-1106.111' (source package linux-kvm version '5.15.0-1106.111') was added. linux-headers-5.15.0-1106-kvm version '5.15.0-1106.111' has the same source package name, linux-kvm, as removed package linux-headers-5.15.0-1105-kvm. As such we can use the source package version of the removed package, '5.15.0-1105.110', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-image-5.15.0-1106-kvm", "from_version": { "source_package_name": "linux-signed-kvm", "source_package_version": "5.15.0-1105.110", "version": null }, "to_version": { "source_package_name": "linux-signed-kvm", "source_package_version": "5.15.0-1106.111", "version": "5.15.0-1106.111" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 5.15.0-1106.111", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed-kvm", "version": "5.15.0-1106.111", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1786013 ], "author": "Manuel Diewald ", "date": "Tue, 11 Aug 2026 16:31:50 +0200" } ], "notes": "linux-image-5.15.0-1106-kvm version '5.15.0-1106.111' (source package linux-signed-kvm version '5.15.0-1106.111') was added. linux-image-5.15.0-1106-kvm version '5.15.0-1106.111' has the same source package name, linux-signed-kvm, as removed package linux-image-5.15.0-1105-kvm. As such we can use the source package version of the removed package, '5.15.0-1105.110', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-kvm-headers-5.15.0-1106", "from_version": { "source_package_name": "linux-kvm", "source_package_version": "5.15.0-1105.110", "version": null }, "to_version": { "source_package_name": "linux-kvm", "source_package_version": "5.15.0-1106.111", "version": "5.15.0-1106.111" }, "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162280, 2163031, 2162294 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux-kvm: 5.15.0-1106.111 -proposed tracker (LP: #2162280)", "", " [ Ubuntu: 5.15.0-190.200 ]", "", " * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)", " * CVE-2026-53246", " - sctp: delete the nested flexible array peer_init", "", " [ Ubuntu: 5.15.0-188.198 ]", "", " * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux-kvm", "version": "5.15.0-1106.111", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2162280, 2163031, 2162294 ], "author": "Manuel Diewald ", "date": "Tue, 11 Aug 2026 16:31:15 +0200" } ], "notes": "linux-kvm-headers-5.15.0-1106 version '5.15.0-1106.111' (source package linux-kvm version '5.15.0-1106.111') was added. linux-kvm-headers-5.15.0-1106 version '5.15.0-1106.111' has the same source package name, linux-kvm, as removed package linux-headers-5.15.0-1105-kvm. As such we can use the source package version of the removed package, '5.15.0-1105.110', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-5.15.0-1106-kvm", "from_version": { "source_package_name": "linux-kvm", "source_package_version": "5.15.0-1105.110", "version": null }, "to_version": { "source_package_name": "linux-kvm", "source_package_version": "5.15.0-1106.111", "version": "5.15.0-1106.111" }, "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162280, 2163031, 2162294 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux-kvm: 5.15.0-1106.111 -proposed tracker (LP: #2162280)", "", " [ Ubuntu: 5.15.0-190.200 ]", "", " * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)", " * CVE-2026-53246", " - sctp: delete the nested flexible array peer_init", "", " [ Ubuntu: 5.15.0-188.198 ]", "", " * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux-kvm", "version": "5.15.0-1106.111", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2162280, 2163031, 2162294 ], "author": "Manuel Diewald ", "date": "Tue, 11 Aug 2026 16:31:15 +0200" } ], "notes": "linux-modules-5.15.0-1106-kvm version '5.15.0-1106.111' (source package linux-kvm version '5.15.0-1106.111') was added. linux-modules-5.15.0-1106-kvm version '5.15.0-1106.111' has the same source package name, linux-kvm, as removed package linux-headers-5.15.0-1105-kvm. As such we can use the source package version of the removed package, '5.15.0-1105.110', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-headers-5.15.0-1105-kvm", "from_version": { "source_package_name": "linux-kvm", "source_package_version": "5.15.0-1105.110", "version": "5.15.0-1105.110" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-5.15.0-1105-kvm", "from_version": { "source_package_name": "linux-signed-kvm", "source_package_version": "5.15.0-1105.110", "version": "5.15.0-1105.110" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-kvm-headers-5.15.0-1105", "from_version": { "source_package_name": "linux-kvm", "source_package_version": "5.15.0-1105.110", "version": "5.15.0-1105.110" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-5.15.0-1105-kvm", "from_version": { "source_package_name": "linux-kvm", "source_package_version": "5.15.0-1105.110", "version": "5.15.0-1105.110" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20260806 to 20260818", "from_series": "jammy", "to_series": "jammy", "from_serial": "20260806", "to_serial": "20260818", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }