{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-image-7.0.0-30-generic", "linux-main-modules-zfs-7.0.0-30-generic", "linux-modules-7.0.0-30-generic" ], "removed": [ "linux-image-7.0.0-28-generic", "linux-main-modules-zfs-7.0.0-28-generic", "linux-modules-7.0.0-28-generic", "pollinate", "xxd" ], "diff": [ "apparmor", "cloud-init", "cloud-init-base", "console-setup", "console-setup-linux", "curl", "distro-info-data", "grub-pc", "grub-pc-bin", "grub2-common", "keyboard-configuration", "libapparmor1", "libc-bin", "libc-gconv-modules-extra", "libc6", "libcurl4t64", "libpam-modules", "libpam-modules-bin", "libpam-runtime", "libpam-systemd", "libpam0g", "libssl3t64", "libsystemd-shared", "libsystemd0", "libudev1", "linux-image-virtual", "openssl", "openssl-provider-legacy", "snapd", "systemd", "systemd-resolved", "systemd-sysv", "tzdata", "ubuntu-cloud-minimal", "udev", "wget" ] } }, "diff": { "deb": [ { "name": "apparmor", "from_version": { "source_package_name": "apparmor", "source_package_version": "5.0.0~beta1-0ubuntu7", "version": "5.0.0~beta1-0ubuntu7" }, "to_version": { "source_package_name": "apparmor", "source_package_version": "5.0.2-0ubuntu1~26.04.1", "version": "5.0.2-0ubuntu1~26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2161458, 2158941, 2158939, 2157575, 2152079 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release (SRU backport). (LP: #2161458)", " * Upstream release contains fixes for:", " - uucore locales reads (LP: #2158941)", " - lsusb uevent file reads (LP: #2158939)", " - alsamixer asound config reads (LP: #2157575)", " * d/apparmor.install: add the new glycin.* profiles", " * d/libapparmor1.symbols: add the new library symbols", " * d/rules: add profiles check to testing step", " * d/watch:", " - Update regex to handle -rc version numbers", " - Update to version 5 of the format", " * Refresh patches to apply to upstream release:", " - d/p/u/profiles-grant-access-to-systemd-resolved.patch", " - d/p/u/aa-notify-fallback-to-ev-comm-when-ev-execpath.patch", " * Update patches to apply to upstream release:", " - d/p/u/samba-systemd-interaction.patch", " - d/p/u/profiles_disable_curl.patch", " - d/p/u/profiles_add_more_consoles_workaround.patch", " - d/p/u/profiles-use-coreutils-tunable.patch", " - d/p/u/0001-parser-add-more-reserved-mediation-classes.patch", " - d/p/u/0007-Set-parser-network.h-ip_conds-ptrs-to-null-in-its-fr.patch", " * Drop patches that were applied upstream:", " - d/p/u/libapparmor-move-aa_get_lsm_iface-decl-in-libapparmor.patch", " - d/p/u/0001-parser-set-umask-before-creating-temp-file.patch", " - d/p/u/0002-parser-restrict-umask-to-allow-only-user-permissions.patch", " - d/p/u/libapparmor-add-test-for-libapparmor-features-prefix.patch", " - d/p/u/transmission-common-fixes-for-lp-2137395.patch", " - d/p/u/unix-chkpwd-add-disconnected-run-paths.patch", " - d/p/u/profiles-add-extensions-to-allowed-ghostscript.patch", " - d/p/u/profiles-expand-the-allowed-directories-for-ghostscript.patch", " - d/p/u/profiles-add-sys-kernel-mm-transparent_hugepage-enable.patch", " - d/p/u/0006-parser-name-ns_domain-and-network_v9-classes.patch", " - d/p/u/0011-utils-add-support-for-iface-an-label-in-network-rule.patch", " - d/p/u/0013-parser-fix-FTBFS-due-to-missing-merge-edit.patch", " - d/p/u/0014-tests-check-if-skb-mediation-is-enabled.patch", " - d/p/u/snap-browser-add-missing-perms-when-opening-from-link.patch", " - d/p/u/lsusb-allow-reading-etc-udev-hwdb-bin.patch", " - d/p/u/profiles-grant-unix-domain-socket-access-to-sanitize.patch", " - d/p/u/0002-parser-refactor-compressed-policy-cache.patch", " - d/p/u/0003-parser-handle-compressed-cache-on-kernels-without-de.patch", " - d/p/u/0004-regression-fix-the-e2e-test-for-compressed-caches.patch", " * Drop patches that were superseded upstream:", " - d/p/u/0002-parser-convert-conditionals-operators-to-an-enum.patch", " - d/p/u/0003-parser-add-override-assign-to-cond-list-elements.patch", " - d/p/u/0004-parser-support-network-interface-conditional.patch", " - d/p/u/0005-tests-add-network-interface-tests.patch", " - d/p/u/0008-parser-move-to-encode-an-alternation-of-a-null-trans.patch", " - d/p/u/0009-parser-disable-ability-to-specify-interface-on-peer-.patch", " - d/p/u/0010-parser-fix-iface-perms-to-work-when-v9-and-v9_skb-ar.patch", " - d/p/u/0012-parser-fix-label-match-for-default-label-values.patch", " - d/p/u/0001-parser-fix-rewriting-of-cache-after-zstd-recompressi.patch", " * Add patches to fix FTBFS (profile test enabling):", " - d/p/u/profiles-allow-more-attach-disconnected.patch", " * Update patches to fix FTBFS (profile test enabling):", " - d/p/u/openvpn_mr_1263.patch", " - d/p/u/irssi_mr_1332.patch", " - d/p/u/os_prober_mr_1569.patch", " - d/p/u/profiles_disable_free.patch", " - d/p/u/profiles_disable_curl.patch", " - d/p/u/profiles-tunables-add-coreutils-var.patch", " - d/p/u/profiles-use-coreutils-tunable.patch", " - d/p/u/profiles-pull-openvpn-profile.patch", " * Add patch to fix transmission-gtk file chooser (LP: #2152079):", " - d/p/u/profiles-add-file-chooser-rules-to-abstractions-trans.patch", "" ], "package": "apparmor", "version": "5.0.2-0ubuntu1~26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2161458, 2158941, 2158939, 2157575, 2152079 ], "author": "Ryan Lee ", "date": "Mon, 13 Jul 2026 10:43:46 -0700" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-init", "from_version": { "source_package_name": "cloud-init", "source_package_version": "26.1-0ubuntu2", "version": "26.1-0ubuntu2" }, "to_version": { "source_package_name": "cloud-init", "source_package_version": "26.1-0ubuntu3~26.04.1", "version": "26.1-0ubuntu3~26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2161665 ], "changes": [ { "cves": [], "log": [ "", " * cherry-pick bd85f29d: fix(oracle): detect iSCSI root via iBFT for", " dracut images (LP: #2161665)", "" ], "package": "cloud-init", "version": "26.1-0ubuntu3~26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2161665 ], "author": "Chad Smith ", "date": "Thu, 23 Jul 2026 10:34:30 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-init-base", "from_version": { "source_package_name": "cloud-init", "source_package_version": "26.1-0ubuntu2", "version": "26.1-0ubuntu2" }, "to_version": { "source_package_name": "cloud-init", "source_package_version": "26.1-0ubuntu3~26.04.1", "version": "26.1-0ubuntu3~26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2161665 ], "changes": [ { "cves": [], "log": [ "", " * cherry-pick bd85f29d: fix(oracle): detect iSCSI root via iBFT for", " dracut images (LP: #2161665)", "" ], "package": "cloud-init", "version": "26.1-0ubuntu3~26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2161665 ], "author": "Chad Smith ", "date": "Thu, 23 Jul 2026 10:34:30 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "console-setup", "from_version": { "source_package_name": "console-setup", "source_package_version": "1.237ubuntu3", "version": "1.237ubuntu3" }, "to_version": { "source_package_name": "console-setup", "source_package_version": "1.237ubuntu3.1", "version": "1.237ubuntu3.1" }, "cves": [], "launchpad_bugs_fixed": [ 2152901 ], "changes": [ { "cves": [], "log": [ "", " * No change rebuild against keymapper 0.6.4ubuntu0~26.04 (LP: #2152901).", " This should produce the expected pc105.tree file that core24-based", " Subiquity consumes at build time.", "" ], "package": "console-setup", "version": "1.237ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2152901 ], "author": "Olivier Gayot ", "date": "Thu, 25 Jun 2026 11:51:10 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "console-setup-linux", "from_version": { "source_package_name": "console-setup", "source_package_version": "1.237ubuntu3", "version": "1.237ubuntu3" }, "to_version": { "source_package_name": "console-setup", "source_package_version": "1.237ubuntu3.1", "version": "1.237ubuntu3.1" }, "cves": [], "launchpad_bugs_fixed": [ 2152901 ], "changes": [ { "cves": [], "log": [ "", " * No change rebuild against keymapper 0.6.4ubuntu0~26.04 (LP: #2152901).", " This should produce the expected pc105.tree file that core24-based", " Subiquity consumes at build time.", "" ], "package": "console-setup", "version": "1.237ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2152901 ], "author": "Olivier Gayot ", "date": "Thu, 25 Jun 2026 11:51:10 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.3", "version": "8.18.0-1ubuntu2.3" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.4", "version": "8.18.0-1ubuntu2.4" }, "cves": [ { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", "" ], "package": "curl", "version": "8.18.0-1ubuntu2.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 17:08:49 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "distro-info-data", "from_version": { "source_package_name": "distro-info-data", "source_package_version": "0.68ubuntu0.1", "version": "0.68ubuntu0.1" }, "to_version": { "source_package_name": "distro-info-data", "source_package_version": "0.72-0ubuntu0.26.04.1", "version": "0.72-0ubuntu0.26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2131678 ], "changes": [ { "cves": [], "log": [ "", " * New data update release", " - Ubuntu Legacy Support extension has been increased to 15 years", " (LP: #2131678)", " * Convert source package from a native package to an upstream package to", " make it easier to track differences in the data versus in the packaging.", "" ], "package": "distro-info-data", "version": "0.72-0ubuntu0.26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2131678 ], "author": "Benjamin Drung ", "date": "Tue, 14 Jul 2026 12:47:46 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "grub-pc", "from_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu2", "version": "2.14-2ubuntu2" }, "to_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu2.1", "version": "2.14-2ubuntu2.1" }, "cves": [], "launchpad_bugs_fixed": [ 2156423 ], "changes": [ { "cves": [], "log": [ "", " * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)", "" ], "package": "grub2", "version": "2.14-2ubuntu2.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2156423 ], "author": "Mate Kukri ", "date": "Wed, 01 Jul 2026 10:30:38 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "grub-pc-bin", "from_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu2", "version": "2.14-2ubuntu2" }, "to_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu2.1", "version": "2.14-2ubuntu2.1" }, "cves": [], "launchpad_bugs_fixed": [ 2156423 ], "changes": [ { "cves": [], "log": [ "", " * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)", "" ], "package": "grub2", "version": "2.14-2ubuntu2.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2156423 ], "author": "Mate Kukri ", "date": "Wed, 01 Jul 2026 10:30:38 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "grub2-common", "from_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu2", "version": "2.14-2ubuntu2" }, "to_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu2.1", "version": "2.14-2ubuntu2.1" }, "cves": [], "launchpad_bugs_fixed": [ 2156423 ], "changes": [ { "cves": [], "log": [ "", " * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)", "" ], "package": "grub2", "version": "2.14-2ubuntu2.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2156423 ], "author": "Mate Kukri ", "date": "Wed, 01 Jul 2026 10:30:38 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "keyboard-configuration", "from_version": { "source_package_name": "console-setup", "source_package_version": "1.237ubuntu3", "version": "1.237ubuntu3" }, "to_version": { "source_package_name": "console-setup", "source_package_version": "1.237ubuntu3.1", "version": "1.237ubuntu3.1" }, "cves": [], "launchpad_bugs_fixed": [ 2152901 ], "changes": [ { "cves": [], "log": [ "", " * No change rebuild against keymapper 0.6.4ubuntu0~26.04 (LP: #2152901).", " This should produce the expected pc105.tree file that core24-based", " Subiquity consumes at build time.", "" ], "package": "console-setup", "version": "1.237ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2152901 ], "author": "Olivier Gayot ", "date": "Thu, 25 Jun 2026 11:51:10 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libapparmor1", "from_version": { "source_package_name": "apparmor", "source_package_version": "5.0.0~beta1-0ubuntu7", "version": "5.0.0~beta1-0ubuntu7" }, "to_version": { "source_package_name": "apparmor", "source_package_version": "5.0.2-0ubuntu1~26.04.1", "version": "5.0.2-0ubuntu1~26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2161458, 2158941, 2158939, 2157575, 2152079 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release (SRU backport). (LP: #2161458)", " * Upstream release contains fixes for:", " - uucore locales reads (LP: #2158941)", " - lsusb uevent file reads (LP: #2158939)", " - alsamixer asound config reads (LP: #2157575)", " * d/apparmor.install: add the new glycin.* profiles", " * d/libapparmor1.symbols: add the new library symbols", " * d/rules: add profiles check to testing step", " * d/watch:", " - Update regex to handle -rc version numbers", " - Update to version 5 of the format", " * Refresh patches to apply to upstream release:", " - d/p/u/profiles-grant-access-to-systemd-resolved.patch", " - d/p/u/aa-notify-fallback-to-ev-comm-when-ev-execpath.patch", " * Update patches to apply to upstream release:", " - d/p/u/samba-systemd-interaction.patch", " - d/p/u/profiles_disable_curl.patch", " - d/p/u/profiles_add_more_consoles_workaround.patch", " - d/p/u/profiles-use-coreutils-tunable.patch", " - d/p/u/0001-parser-add-more-reserved-mediation-classes.patch", " - d/p/u/0007-Set-parser-network.h-ip_conds-ptrs-to-null-in-its-fr.patch", " * Drop patches that were applied upstream:", " - d/p/u/libapparmor-move-aa_get_lsm_iface-decl-in-libapparmor.patch", " - d/p/u/0001-parser-set-umask-before-creating-temp-file.patch", " - d/p/u/0002-parser-restrict-umask-to-allow-only-user-permissions.patch", " - d/p/u/libapparmor-add-test-for-libapparmor-features-prefix.patch", " - d/p/u/transmission-common-fixes-for-lp-2137395.patch", " - d/p/u/unix-chkpwd-add-disconnected-run-paths.patch", " - d/p/u/profiles-add-extensions-to-allowed-ghostscript.patch", " - d/p/u/profiles-expand-the-allowed-directories-for-ghostscript.patch", " - d/p/u/profiles-add-sys-kernel-mm-transparent_hugepage-enable.patch", " - d/p/u/0006-parser-name-ns_domain-and-network_v9-classes.patch", " - d/p/u/0011-utils-add-support-for-iface-an-label-in-network-rule.patch", " - d/p/u/0013-parser-fix-FTBFS-due-to-missing-merge-edit.patch", " - d/p/u/0014-tests-check-if-skb-mediation-is-enabled.patch", " - d/p/u/snap-browser-add-missing-perms-when-opening-from-link.patch", " - d/p/u/lsusb-allow-reading-etc-udev-hwdb-bin.patch", " - d/p/u/profiles-grant-unix-domain-socket-access-to-sanitize.patch", " - d/p/u/0002-parser-refactor-compressed-policy-cache.patch", " - d/p/u/0003-parser-handle-compressed-cache-on-kernels-without-de.patch", " - d/p/u/0004-regression-fix-the-e2e-test-for-compressed-caches.patch", " * Drop patches that were superseded upstream:", " - d/p/u/0002-parser-convert-conditionals-operators-to-an-enum.patch", " - d/p/u/0003-parser-add-override-assign-to-cond-list-elements.patch", " - d/p/u/0004-parser-support-network-interface-conditional.patch", " - d/p/u/0005-tests-add-network-interface-tests.patch", " - d/p/u/0008-parser-move-to-encode-an-alternation-of-a-null-trans.patch", " - d/p/u/0009-parser-disable-ability-to-specify-interface-on-peer-.patch", " - d/p/u/0010-parser-fix-iface-perms-to-work-when-v9-and-v9_skb-ar.patch", " - d/p/u/0012-parser-fix-label-match-for-default-label-values.patch", " - d/p/u/0001-parser-fix-rewriting-of-cache-after-zstd-recompressi.patch", " * Add patches to fix FTBFS (profile test enabling):", " - d/p/u/profiles-allow-more-attach-disconnected.patch", " * Update patches to fix FTBFS (profile test enabling):", " - d/p/u/openvpn_mr_1263.patch", " - d/p/u/irssi_mr_1332.patch", " - d/p/u/os_prober_mr_1569.patch", " - d/p/u/profiles_disable_free.patch", " - d/p/u/profiles_disable_curl.patch", " - d/p/u/profiles-tunables-add-coreutils-var.patch", " - d/p/u/profiles-use-coreutils-tunable.patch", " - d/p/u/profiles-pull-openvpn-profile.patch", " * Add patch to fix transmission-gtk file chooser (LP: #2152079):", " - d/p/u/profiles-add-file-chooser-rules-to-abstractions-trans.patch", "" ], "package": "apparmor", "version": "5.0.2-0ubuntu1~26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2161458, 2158941, 2158939, 2157575, 2152079 ], "author": "Ryan Lee ", "date": "Mon, 13 Jul 2026 10:43:46 -0700" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2", "version": "2.43-2ubuntu2" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.3", "version": "2.43-2ubuntu2.3" }, "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: assertion failure via IBM1390 or IBM1399 charsets", " - debian/patches/CVE-2026-4046.patch: Use pending character state in", " IBM1390, IBM1399 character sets in iconvdata/Makefile,", " iconvdata/ibm1364.c, iconvdata/tst-bug33980.c.", " - CVE-2026-4046", " * SECURITY UPDATE: out-of-bounds write in deprecated debugging function", " - debian/patches/CVE-2026-5435.patch: resolv: More types as unknown in", " ns_sprintrrf in resolv/ns_print.c.", " - CVE-2026-5435", " * SECURITY UPDATE: one byte heap buffer overflow in scanf %mc", " - debian/patches/CVE-2026-5450.patch: stdio-common: Fix buffer overflow in", " scanf %mc [BZ #34008] in stdio-common/Makefile, stdio-common/tst-vfscanf-", " bz34008.c, stdio-common/vfscanf-internal.c.", " - CVE-2026-5450", " * SECURITY UPDATE: crash or info disclosure in ungetwc function", " - debian/patches/CVE-2026-5928.patch: libio: Fix ungetwc operating on byte", " stream in libio/Makefile, libio/bug-wgenops-bz33998.c, libio/wgenops.c.", " - CVE-2026-5928", " * SECURITY UPDATE: crash in deprecated debugging functions", " - debian/patches/CVE-2026-6238-pre1.patch: resolv: Declare __p_class_syms,", " __p_type_syms for internal use in include/resolv.h, resolv/res_debug.c.", " - debian/patches/CVE-2026-6238-pre2.patch: resolv: Fix ns_sprintrrf", " formatting of class, type values in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre3.patch: resolv: Improve formatting of", " unknown records in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre4.patch: resolv: Check for inet_ntop", " failure in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-1.patch: resolv: Fix buffer overreads in", " ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-2.patch: resolv: Add test case tst-", " ns_sprintrr in resolv/Makefile, resolv/tst-ns_sprintrr.c.", " - CVE-2026-6238", " * Disable failing tests because of rust-coreutils (LP: 2161727)", " - debian/testsuite-xfail-debian.mk: added tst-spawn-chdir and", " tst-spawn-chdir-pidfd.", "" ], "package": "glibc", "version": "2.43-2ubuntu2.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 22 Jul 2026 13:24:47 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-gconv-modules-extra", "from_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2", "version": "2.43-2ubuntu2" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.3", "version": "2.43-2ubuntu2.3" }, "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: assertion failure via IBM1390 or IBM1399 charsets", " - debian/patches/CVE-2026-4046.patch: Use pending character state in", " IBM1390, IBM1399 character sets in iconvdata/Makefile,", " iconvdata/ibm1364.c, iconvdata/tst-bug33980.c.", " - CVE-2026-4046", " * SECURITY UPDATE: out-of-bounds write in deprecated debugging function", " - debian/patches/CVE-2026-5435.patch: resolv: More types as unknown in", " ns_sprintrrf in resolv/ns_print.c.", " - CVE-2026-5435", " * SECURITY UPDATE: one byte heap buffer overflow in scanf %mc", " - debian/patches/CVE-2026-5450.patch: stdio-common: Fix buffer overflow in", " scanf %mc [BZ #34008] in stdio-common/Makefile, stdio-common/tst-vfscanf-", " bz34008.c, stdio-common/vfscanf-internal.c.", " - CVE-2026-5450", " * SECURITY UPDATE: crash or info disclosure in ungetwc function", " - debian/patches/CVE-2026-5928.patch: libio: Fix ungetwc operating on byte", " stream in libio/Makefile, libio/bug-wgenops-bz33998.c, libio/wgenops.c.", " - CVE-2026-5928", " * SECURITY UPDATE: crash in deprecated debugging functions", " - debian/patches/CVE-2026-6238-pre1.patch: resolv: Declare __p_class_syms,", " __p_type_syms for internal use in include/resolv.h, resolv/res_debug.c.", " - debian/patches/CVE-2026-6238-pre2.patch: resolv: Fix ns_sprintrrf", " formatting of class, type values in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre3.patch: resolv: Improve formatting of", " unknown records in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre4.patch: resolv: Check for inet_ntop", " failure in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-1.patch: resolv: Fix buffer overreads in", " ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-2.patch: resolv: Add test case tst-", " ns_sprintrr in resolv/Makefile, resolv/tst-ns_sprintrr.c.", " - CVE-2026-6238", " * Disable failing tests because of rust-coreutils (LP: 2161727)", " - debian/testsuite-xfail-debian.mk: added tst-spawn-chdir and", " tst-spawn-chdir-pidfd.", "" ], "package": "glibc", "version": "2.43-2ubuntu2.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 22 Jul 2026 13:24:47 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6", "from_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2", "version": "2.43-2ubuntu2" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.43-2ubuntu2.3", "version": "2.43-2ubuntu2.3" }, "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: assertion failure via IBM1390 or IBM1399 charsets", " - debian/patches/CVE-2026-4046.patch: Use pending character state in", " IBM1390, IBM1399 character sets in iconvdata/Makefile,", " iconvdata/ibm1364.c, iconvdata/tst-bug33980.c.", " - CVE-2026-4046", " * SECURITY UPDATE: out-of-bounds write in deprecated debugging function", " - debian/patches/CVE-2026-5435.patch: resolv: More types as unknown in", " ns_sprintrrf in resolv/ns_print.c.", " - CVE-2026-5435", " * SECURITY UPDATE: one byte heap buffer overflow in scanf %mc", " - debian/patches/CVE-2026-5450.patch: stdio-common: Fix buffer overflow in", " scanf %mc [BZ #34008] in stdio-common/Makefile, stdio-common/tst-vfscanf-", " bz34008.c, stdio-common/vfscanf-internal.c.", " - CVE-2026-5450", " * SECURITY UPDATE: crash or info disclosure in ungetwc function", " - debian/patches/CVE-2026-5928.patch: libio: Fix ungetwc operating on byte", " stream in libio/Makefile, libio/bug-wgenops-bz33998.c, libio/wgenops.c.", " - CVE-2026-5928", " * SECURITY UPDATE: crash in deprecated debugging functions", " - debian/patches/CVE-2026-6238-pre1.patch: resolv: Declare __p_class_syms,", " __p_type_syms for internal use in include/resolv.h, resolv/res_debug.c.", " - debian/patches/CVE-2026-6238-pre2.patch: resolv: Fix ns_sprintrrf", " formatting of class, type values in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre3.patch: resolv: Improve formatting of", " unknown records in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre4.patch: resolv: Check for inet_ntop", " failure in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-1.patch: resolv: Fix buffer overreads in", " ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-2.patch: resolv: Add test case tst-", " ns_sprintrr in resolv/Makefile, resolv/tst-ns_sprintrr.c.", " - CVE-2026-6238", " * Disable failing tests because of rust-coreutils (LP: 2161727)", " - debian/testsuite-xfail-debian.mk: added tst-spawn-chdir and", " tst-spawn-chdir-pidfd.", "" ], "package": "glibc", "version": "2.43-2ubuntu2.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 22 Jul 2026 13:24:47 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4t64", "from_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.3", "version": "8.18.0-1ubuntu2.3" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.4", "version": "8.18.0-1ubuntu2.4" }, "cves": [ { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", "" ], "package": "curl", "version": "8.18.0-1ubuntu2.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 17:08:49 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules", "from_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3", "version": "1.7.0-5ubuntu3" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.1", "version": "1.7.0-5ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.7.0-5ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 09:34:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules-bin", "from_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3", "version": "1.7.0-5ubuntu3" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.1", "version": "1.7.0-5ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.7.0-5ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 09:34:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-runtime", "from_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3", "version": "1.7.0-5ubuntu3" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.1", "version": "1.7.0-5ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.7.0-5ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 09:34:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3", "version": "259.5-0ubuntu3" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2158686, 2157342, 2157344, 2148619, 2150773, 2155132 ], "changes": [ { "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: systemd-homed: local privilege escalation via missing", " home-record signature verification on the authenticate path", " - homed-fix-verification-of-local-identity-file.patch", " - homed-verify-privileged-worker-changes.patch", " - CVE-2026-16742", " * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary", " processes", " - CVE-2026-15059.patch", " - CVE-2026-15059", " * SECURITY UPDATE: systemd-machined: unprivileged users can terminate", " arbitrary processes", " - CVE-2026-15060.patch", " - CVE-2026-15060", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure", " via systemd-machined", " - GHSA-2p9f-rcmv-x36h.patch", " - GHSA-2p9f-rcmv-x36h", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - dns-question-limit-the-number-of-questions-per-query.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-limit-the-number-of-env-variables-to-something-re.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "259.5-0ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 27 Jul 2026 16:44:02 -0400" }, { "cves": [], "log": [ "", " * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.", " Otherwise, the debhelper-generated systemd-tmpfiles call will include", " var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when", " the systemd package is upgraded. (LP: #2158686)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158686 ], "author": "Nick Rosbrook ", "date": "Wed, 22 Jul 2026 13:07:19 -0400" }, { "cves": [], "log": [ "", " * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)", " * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts", " (LP: #2157344)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157342, 2157344 ], "author": "Nick Rosbrook ", "date": "Thu, 18 Jun 2026 10:27:05 -0400" }, { "cves": [], "log": [ "", " * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)", " - units: order networkd resolve hook After=network-pre.target", " - units: drop Before=sockets.target from networkd resolve hook", " * core: Open netfilter socket only when needed (LP: #2150773)", " * mkosi: trim verity.sig json files to remove NUL padding before passing to jq", " (LP: #2155132)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148619, 2150773, 2155132 ], "author": "Nick Rosbrook ", "date": "Tue, 09 Jun 2026 08:59:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam0g", "from_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3", "version": "1.7.0-5ubuntu3" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.7.0-5ubuntu3.1", "version": "1.7.0-5ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.7.0-5ubuntu3.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 09:34:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssl3t64", "from_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.2", "version": "3.5.5-1ubuntu3.2" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.3", "version": "3.5.5-1ubuntu3.3" }, "cves": [], "launchpad_bugs_fixed": [ 2161371 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: HollowByte Denial of Service issue (LP: #2161371)", " - debian/patches/lp2161371.patch: Grow the init_buf incrementally as we", " receive data in ssl/statem/statem.c, ssl/statem/statem_lib.c.", " - No CVE number", "" ], "package": "openssl", "version": "3.5.5-1ubuntu3.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2161371 ], "author": "Marc Deslauriers ", "date": "Wed, 29 Jul 2026 12:50:53 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsystemd-shared", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3", "version": "259.5-0ubuntu3" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2158686, 2157342, 2157344, 2148619, 2150773, 2155132 ], "changes": [ { "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: systemd-homed: local privilege escalation via missing", " home-record signature verification on the authenticate path", " - homed-fix-verification-of-local-identity-file.patch", " - homed-verify-privileged-worker-changes.patch", " - CVE-2026-16742", " * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary", " processes", " - CVE-2026-15059.patch", " - CVE-2026-15059", " * SECURITY UPDATE: systemd-machined: unprivileged users can terminate", " arbitrary processes", " - CVE-2026-15060.patch", " - CVE-2026-15060", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure", " via systemd-machined", " - GHSA-2p9f-rcmv-x36h.patch", " - GHSA-2p9f-rcmv-x36h", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - dns-question-limit-the-number-of-questions-per-query.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-limit-the-number-of-env-variables-to-something-re.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "259.5-0ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 27 Jul 2026 16:44:02 -0400" }, { "cves": [], "log": [ "", " * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.", " Otherwise, the debhelper-generated systemd-tmpfiles call will include", " var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when", " the systemd package is upgraded. (LP: #2158686)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158686 ], "author": "Nick Rosbrook ", "date": "Wed, 22 Jul 2026 13:07:19 -0400" }, { "cves": [], "log": [ "", " * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)", " * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts", " (LP: #2157344)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157342, 2157344 ], "author": "Nick Rosbrook ", "date": "Thu, 18 Jun 2026 10:27:05 -0400" }, { "cves": [], "log": [ "", " * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)", " - units: order networkd resolve hook After=network-pre.target", " - units: drop Before=sockets.target from networkd resolve hook", " * core: Open netfilter socket only when needed (LP: #2150773)", " * mkosi: trim verity.sig json files to remove NUL padding before passing to jq", " (LP: #2155132)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148619, 2150773, 2155132 ], "author": "Nick Rosbrook ", "date": "Tue, 09 Jun 2026 08:59:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsystemd0", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3", "version": "259.5-0ubuntu3" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2158686, 2157342, 2157344, 2148619, 2150773, 2155132 ], "changes": [ { "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: systemd-homed: local privilege escalation via missing", " home-record signature verification on the authenticate path", " - homed-fix-verification-of-local-identity-file.patch", " - homed-verify-privileged-worker-changes.patch", " - CVE-2026-16742", " * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary", " processes", " - CVE-2026-15059.patch", " - CVE-2026-15059", " * SECURITY UPDATE: systemd-machined: unprivileged users can terminate", " arbitrary processes", " - CVE-2026-15060.patch", " - CVE-2026-15060", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure", " via systemd-machined", " - GHSA-2p9f-rcmv-x36h.patch", " - GHSA-2p9f-rcmv-x36h", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - dns-question-limit-the-number-of-questions-per-query.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-limit-the-number-of-env-variables-to-something-re.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "259.5-0ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 27 Jul 2026 16:44:02 -0400" }, { "cves": [], "log": [ "", " * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.", " Otherwise, the debhelper-generated systemd-tmpfiles call will include", " var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when", " the systemd package is upgraded. (LP: #2158686)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158686 ], "author": "Nick Rosbrook ", "date": "Wed, 22 Jul 2026 13:07:19 -0400" }, { "cves": [], "log": [ "", " * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)", " * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts", " (LP: #2157344)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157342, 2157344 ], "author": "Nick Rosbrook ", "date": "Thu, 18 Jun 2026 10:27:05 -0400" }, { "cves": [], "log": [ "", " * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)", " - units: order networkd resolve hook After=network-pre.target", " - units: drop Before=sockets.target from networkd resolve hook", " * core: Open netfilter socket only when needed (LP: #2150773)", " * mkosi: trim verity.sig json files to remove NUL padding before passing to jq", " (LP: #2155132)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148619, 2150773, 2155132 ], "author": "Nick Rosbrook ", "date": "Tue, 09 Jun 2026 08:59:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libudev1", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3", "version": "259.5-0ubuntu3" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2158686, 2157342, 2157344, 2148619, 2150773, 2155132 ], "changes": [ { "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: systemd-homed: local privilege escalation via missing", " home-record signature verification on the authenticate path", " - homed-fix-verification-of-local-identity-file.patch", " - homed-verify-privileged-worker-changes.patch", " - CVE-2026-16742", " * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary", " processes", " - CVE-2026-15059.patch", " - CVE-2026-15059", " * SECURITY UPDATE: systemd-machined: unprivileged users can terminate", " arbitrary processes", " - CVE-2026-15060.patch", " - CVE-2026-15060", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure", " via systemd-machined", " - GHSA-2p9f-rcmv-x36h.patch", " - GHSA-2p9f-rcmv-x36h", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - dns-question-limit-the-number-of-questions-per-query.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-limit-the-number-of-env-variables-to-something-re.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "259.5-0ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 27 Jul 2026 16:44:02 -0400" }, { "cves": [], "log": [ "", " * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.", " Otherwise, the debhelper-generated systemd-tmpfiles call will include", " var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when", " the systemd package is upgraded. (LP: #2158686)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158686 ], "author": "Nick Rosbrook ", "date": "Wed, 22 Jul 2026 13:07:19 -0400" }, { "cves": [], "log": [ "", " * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)", " * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts", " (LP: #2157344)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157342, 2157344 ], "author": "Nick Rosbrook ", "date": "Thu, 18 Jun 2026 10:27:05 -0400" }, { "cves": [], "log": [ "", " * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)", " - units: order networkd resolve hook After=network-pre.target", " - units: drop Before=sockets.target from networkd resolve hook", " * core: Open netfilter socket only when needed (LP: #2150773)", " * mkosi: trim verity.sig json files to remove NUL padding before passing to jq", " (LP: #2155132)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148619, 2150773, 2155132 ], "author": "Nick Rosbrook ", "date": "Tue, 09 Jun 2026 08:59:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-28.28", "version": "7.0.0-28.28" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-30.30", "" ], "package": "linux-meta", "version": "7.0.0-30.30", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 18:27:58 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl", "from_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.2", "version": "3.5.5-1ubuntu3.2" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.3", "version": "3.5.5-1ubuntu3.3" }, "cves": [], "launchpad_bugs_fixed": [ 2161371 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: HollowByte Denial of Service issue (LP: #2161371)", " - debian/patches/lp2161371.patch: Grow the init_buf incrementally as we", " receive data in ssl/statem/statem.c, ssl/statem/statem_lib.c.", " - No CVE number", "" ], "package": "openssl", "version": "3.5.5-1ubuntu3.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2161371 ], "author": "Marc Deslauriers ", "date": "Wed, 29 Jul 2026 12:50:53 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl-provider-legacy", "from_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.2", "version": "3.5.5-1ubuntu3.2" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3.3", "version": "3.5.5-1ubuntu3.3" }, "cves": [], "launchpad_bugs_fixed": [ 2161371 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: HollowByte Denial of Service issue (LP: #2161371)", " - debian/patches/lp2161371.patch: Grow the init_buf incrementally as we", " receive data in ssl/statem/statem.c, ssl/statem/statem_lib.c.", " - No CVE number", "" ], "package": "openssl", "version": "3.5.5-1ubuntu3.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2161371 ], "author": "Marc Deslauriers ", "date": "Wed, 29 Jul 2026 12:50:53 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "snapd", "from_version": { "source_package_name": "snapd", "source_package_version": "2.76+ubuntu26.04.3", "version": "2.76+ubuntu26.04.3" }, "to_version": { "source_package_name": "snapd", "source_package_version": "2.76.3+ubuntu26.04", "version": "2.76.3+ubuntu26.04" }, "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158301, 2159940, 2157692, 2067006 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release, LP: #2158301", " - FDE: support keyboard configuration at install-time for first-boot", " - FDE: re-enable passphrases/PINs at install-time", " - FDE: require volumes authentication if HWROT is missing", " - FDE: bump secboot to rev 457b03a16d19", " - FDE: use new secboot API for reprovision TPM", " - Cross-distro: modify SELinux policy to use", " init_named_socket_activation() for allowing systemd to start snapd", " through socket activation", " - packaging: make sure that usr/bin/snap is built with correct build", " tags on debian sid", " - Ensure profiles are setup before running prepare-{slot, plug}*", " hooks", "" ], "package": "snapd", "version": "2.76.3+ubuntu26.04", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158301 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 10:06:48 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2159940", " - interfaces: steam-support, docker-support | fix mountinfo denial", "" ], "package": "snapd", "version": "2.76.2+ubuntu26.04", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2159940 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 08:38:51 +0200" }, { "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "log": [ "", " * New upstream release, LP: #2157692", " - LP: #2067006 CVE-2024-5300", " - CVE-2026-3888", "" ], "package": "snapd", "version": "2.76.1+ubuntu26.04", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157692, 2067006 ], "author": "Ernest Lotter ", "date": "Thu, 25 Jun 2026 13:09:05 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3", "version": "259.5-0ubuntu3" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2158686, 2157342, 2157344, 2148619, 2150773, 2155132 ], "changes": [ { "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: systemd-homed: local privilege escalation via missing", " home-record signature verification on the authenticate path", " - homed-fix-verification-of-local-identity-file.patch", " - homed-verify-privileged-worker-changes.patch", " - CVE-2026-16742", " * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary", " processes", " - CVE-2026-15059.patch", " - CVE-2026-15059", " * SECURITY UPDATE: systemd-machined: unprivileged users can terminate", " arbitrary processes", " - CVE-2026-15060.patch", " - CVE-2026-15060", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure", " via systemd-machined", " - GHSA-2p9f-rcmv-x36h.patch", " - GHSA-2p9f-rcmv-x36h", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - dns-question-limit-the-number-of-questions-per-query.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-limit-the-number-of-env-variables-to-something-re.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "259.5-0ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 27 Jul 2026 16:44:02 -0400" }, { "cves": [], "log": [ "", " * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.", " Otherwise, the debhelper-generated systemd-tmpfiles call will include", " var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when", " the systemd package is upgraded. (LP: #2158686)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158686 ], "author": "Nick Rosbrook ", "date": "Wed, 22 Jul 2026 13:07:19 -0400" }, { "cves": [], "log": [ "", " * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)", " * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts", " (LP: #2157344)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157342, 2157344 ], "author": "Nick Rosbrook ", "date": "Thu, 18 Jun 2026 10:27:05 -0400" }, { "cves": [], "log": [ "", " * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)", " - units: order networkd resolve hook After=network-pre.target", " - units: drop Before=sockets.target from networkd resolve hook", " * core: Open netfilter socket only when needed (LP: #2150773)", " * mkosi: trim verity.sig json files to remove NUL padding before passing to jq", " (LP: #2155132)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148619, 2150773, 2155132 ], "author": "Nick Rosbrook ", "date": "Tue, 09 Jun 2026 08:59:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-resolved", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3", "version": "259.5-0ubuntu3" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2158686, 2157342, 2157344, 2148619, 2150773, 2155132 ], "changes": [ { "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: systemd-homed: local privilege escalation via missing", " home-record signature verification on the authenticate path", " - homed-fix-verification-of-local-identity-file.patch", " - homed-verify-privileged-worker-changes.patch", " - CVE-2026-16742", " * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary", " processes", " - CVE-2026-15059.patch", " - CVE-2026-15059", " * SECURITY UPDATE: systemd-machined: unprivileged users can terminate", " arbitrary processes", " - CVE-2026-15060.patch", " - CVE-2026-15060", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure", " via systemd-machined", " - GHSA-2p9f-rcmv-x36h.patch", " - GHSA-2p9f-rcmv-x36h", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - dns-question-limit-the-number-of-questions-per-query.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-limit-the-number-of-env-variables-to-something-re.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "259.5-0ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 27 Jul 2026 16:44:02 -0400" }, { "cves": [], "log": [ "", " * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.", " Otherwise, the debhelper-generated systemd-tmpfiles call will include", " var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when", " the systemd package is upgraded. (LP: #2158686)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158686 ], "author": "Nick Rosbrook ", "date": "Wed, 22 Jul 2026 13:07:19 -0400" }, { "cves": [], "log": [ "", " * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)", " * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts", " (LP: #2157344)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157342, 2157344 ], "author": "Nick Rosbrook ", "date": "Thu, 18 Jun 2026 10:27:05 -0400" }, { "cves": [], "log": [ "", " * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)", " - units: order networkd resolve hook After=network-pre.target", " - units: drop Before=sockets.target from networkd resolve hook", " * core: Open netfilter socket only when needed (LP: #2150773)", " * mkosi: trim verity.sig json files to remove NUL padding before passing to jq", " (LP: #2155132)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148619, 2150773, 2155132 ], "author": "Nick Rosbrook ", "date": "Tue, 09 Jun 2026 08:59:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-sysv", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3", "version": "259.5-0ubuntu3" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2158686, 2157342, 2157344, 2148619, 2150773, 2155132 ], "changes": [ { "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: systemd-homed: local privilege escalation via missing", " home-record signature verification on the authenticate path", " - homed-fix-verification-of-local-identity-file.patch", " - homed-verify-privileged-worker-changes.patch", " - CVE-2026-16742", " * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary", " processes", " - CVE-2026-15059.patch", " - CVE-2026-15059", " * SECURITY UPDATE: systemd-machined: unprivileged users can terminate", " arbitrary processes", " - CVE-2026-15060.patch", " - CVE-2026-15060", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure", " via systemd-machined", " - GHSA-2p9f-rcmv-x36h.patch", " - GHSA-2p9f-rcmv-x36h", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - dns-question-limit-the-number-of-questions-per-query.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-limit-the-number-of-env-variables-to-something-re.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "259.5-0ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 27 Jul 2026 16:44:02 -0400" }, { "cves": [], "log": [ "", " * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.", " Otherwise, the debhelper-generated systemd-tmpfiles call will include", " var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when", " the systemd package is upgraded. (LP: #2158686)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158686 ], "author": "Nick Rosbrook ", "date": "Wed, 22 Jul 2026 13:07:19 -0400" }, { "cves": [], "log": [ "", " * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)", " * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts", " (LP: #2157344)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157342, 2157344 ], "author": "Nick Rosbrook ", "date": "Thu, 18 Jun 2026 10:27:05 -0400" }, { "cves": [], "log": [ "", " * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)", " - units: order networkd resolve hook After=network-pre.target", " - units: drop Before=sockets.target from networkd resolve hook", " * core: Open netfilter socket only when needed (LP: #2150773)", " * mkosi: trim verity.sig json files to remove NUL padding before passing to jq", " (LP: #2155132)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148619, 2150773, 2155132 ], "author": "Nick Rosbrook ", "date": "Tue, 09 Jun 2026 08:59:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "tzdata", "from_version": { "source_package_name": "tzdata", "source_package_version": "2026b-0ubuntu0.26.04.1", "version": "2026b-0ubuntu0.26.04.1" }, "to_version": { "source_package_name": "tzdata", "source_package_version": "2026c-0ubuntu0.26.04.1", "version": "2026c-0ubuntu0.26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2161092 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release (LP: #2161092):", " - Alberta moved to permanent -06 on 2026-06-18, so it will not fall back", " from -06 to -07 on 2026-11-01.", " - Morocco moves to permanent +00 on 2026-09-20.", " * Add autopkgtest test case for 2026c release", " * Update the ICU timezone data to 2026c", " * Add autopkgtest test case for ICU timezone data 2026c", "" ], "package": "tzdata", "version": "2026c-0ubuntu0.26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2161092 ], "author": "Benjamin Drung ", "date": "Fri, 17 Jul 2026 14:43:50 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-cloud-minimal", "from_version": { "source_package_name": "ubuntu-meta", "source_package_version": "1.570.1", "version": "1.570.1" }, "to_version": { "source_package_name": "ubuntu-meta", "source_package_version": "1.570.3", "version": "1.570.3" }, "cves": [], "launchpad_bugs_fixed": [ 2162040, 2158262 ], "changes": [ { "cves": [], "log": [ "", " [ Gauthier Jolly ]", " * Refreshed dependencies", " * Added curl explicitly to cloud-minimal and server-minimal after it was", " implicity removed with pollinate's removal (LP: #2162040)", "" ], "package": "ubuntu-meta", "version": "1.570.3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162040 ], "author": "Nick Rosbrook ", "date": "Fri, 31 Jul 2026 08:59:55 -0400" }, { "cves": [], "log": [ "", " * Refreshed dependencies", " * Removed pollinate from cloud-minimal, server, server-minimal,", " server-raspi (LP: #2158262)", "" ], "package": "ubuntu-meta", "version": "1.570.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158262 ], "author": "Christian Ehrhardt ", "date": "Fri, 03 Jul 2026 12:24:53 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "udev", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3", "version": "259.5-0ubuntu3" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2158686, 2157342, 2157344, 2148619, 2150773, 2155132 ], "changes": [ { "cves": [ { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: systemd-homed: local privilege escalation via missing", " home-record signature verification on the authenticate path", " - homed-fix-verification-of-local-identity-file.patch", " - homed-verify-privileged-worker-changes.patch", " - CVE-2026-16742", " * SECURITY UPDATE: systemd-oomd: unprivileged users can terminate arbitrary", " processes", " - CVE-2026-15059.patch", " - CVE-2026-15059", " * SECURITY UPDATE: systemd-machined: unprivileged users can terminate", " arbitrary processes", " - CVE-2026-15060.patch", " - CVE-2026-15060", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: Local KEY=value pairs formatted files content disclosure", " via systemd-machined", " - GHSA-2p9f-rcmv-x36h.patch", " - GHSA-2p9f-rcmv-x36h", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - dns-question-limit-the-number-of-questions-per-query.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-limit-the-number-of-env-variables-to-something-re.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "259.5-0ubuntu3.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 27 Jul 2026 16:44:02 -0400" }, { "cves": [], "log": [ "", " * d/systemd.postinst: move systemd-tmpfiles --create after debhelper.", " Otherwise, the debhelper-generated systemd-tmpfiles call will include", " var.conf, but not rsyslog's 00rsyslog.conf, and breaks rsyslog when", " the systemd package is upgraded. (LP: #2158686)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158686 ], "author": "Nick Rosbrook ", "date": "Wed, 22 Jul 2026 13:07:19 -0400" }, { "cves": [], "log": [ "", " * test: use gnudate in TEST-45-TIMEDATE (LP: #2157342)", " * d/t/upstream: skip TEST-70-TPM2 and TEST-86-MULTI-PROFILE-UKI due to timeouts", " (LP: #2157344)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157342, 2157344 ], "author": "Nick Rosbrook ", "date": "Thu, 18 Jun 2026 10:27:05 -0400" }, { "cves": [], "log": [ "", " * Fix cloud-init delay caused by systemd-networkd resolve hook (LP: #2148619)", " - units: order networkd resolve hook After=network-pre.target", " - units: drop Before=sockets.target from networkd resolve hook", " * core: Open netfilter socket only when needed (LP: #2150773)", " * mkosi: trim verity.sig json files to remove NUL padding before passing to jq", " (LP: #2155132)", "" ], "package": "systemd", "version": "259.5-0ubuntu3.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148619, 2150773, 2155132 ], "author": "Nick Rosbrook ", "date": "Tue, 09 Jun 2026 08:59:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "wget", "from_version": { "source_package_name": "wget", "source_package_version": "1.25.0-2ubuntu4.3", "version": "1.25.0-2ubuntu4.3" }, "to_version": { "source_package_name": "wget", "source_package_version": "1.25.0-2ubuntu4.4", "version": "1.25.0-2ubuntu4.4" }, "cves": [ { "cve": "CVE-2026-58472", "url": "https://ubuntu.com/security/CVE-2026-58472", "cve_description": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163754 ], "changes": [ { "cves": [ { "cve": "CVE-2026-58472", "url": "https://ubuntu.com/security/CVE-2026-58472", "cve_description": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-58472 (LP: #2163754)", " - debian/patches/CVE-2026-58472-post1.patch: Fix buffer overflow in", " src/convert.c", "" ], "package": "wget", "version": "1.25.0-2ubuntu4.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2163754 ], "author": "Kyle Kernick ", "date": "Wed, 19 Aug 2026 17:59:21 -0600" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-image-7.0.0-30-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.0.0-28.28", "version": null }, "to_version": { "source_package_name": "linux-signed", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-30.30", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "7.0.0-30.30", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 18:28:15 +0200" } ], "notes": "linux-image-7.0.0-30-generic version '7.0.0-30.30' (source package linux-signed version '7.0.0-30.30') was added. linux-image-7.0.0-30-generic version '7.0.0-30.30' has the same source package name, linux-signed, as removed package linux-image-7.0.0-28-generic. As such we can use the source package version of the removed package, '7.0.0-28.28', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.0.0-30-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.0.0-28.28+1", "version": null }, "to_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-30.30", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/s2026.07.06)", "", " * Miscellaneous Ubuntu changes", " - [Packaging]: lmm: Add a symbol to use a local signed.tar.gz file", " - [Packaging]: lmm: Allow DKMS to be cross compiled", " - [Packaging]: lmm: Add a method to create unsigned packages", " - [Packaging]: lmm: Install DKMSs in ubuntu/dkms", " - [Packaging]: Update manifest file with new patches", "" ], "package": "linux-main-signed", "version": "7.0.0-30.30", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 18:28:48 +0200" } ], "notes": "linux-main-modules-zfs-7.0.0-30-generic version '7.0.0-30.30' (source package linux-main-signed version '7.0.0-30.30') was added. linux-main-modules-zfs-7.0.0-30-generic version '7.0.0-30.30' has the same source package name, linux-main-signed, as removed package linux-main-modules-zfs-7.0.0-28-generic. As such we can use the source package version of the removed package, '7.0.0-28.28+1', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-30-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-28.28", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162185, 2160781, 1786013, 2158267 ], "changes": [ { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "" ], "package": "linux", "version": "7.0.0-30.30", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162185 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 18:27:29 +0200" }, { "cves": [ { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "" ], "package": "linux", "version": "7.0.0-29.29", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2160781, 1786013, 2158267 ], "author": "Manuel Diewald ", "date": "Fri, 17 Jul 2026 18:57:53 +0200" } ], "notes": "linux-modules-7.0.0-30-generic version '7.0.0-30.30' (source package linux version '7.0.0-30.30') was added. linux-modules-7.0.0-30-generic version '7.0.0-30.30' has the same source package name, linux, as removed package linux-modules-7.0.0-28-generic. As such we can use the source package version of the removed package, '7.0.0-28.28', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-image-7.0.0-28-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.0.0-28.28", "version": "7.0.0-28.28" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.0.0-28-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.0.0-28.28+1", "version": "7.0.0-28.28+1" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-28-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-28.28", "version": "7.0.0-28.28" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "pollinate", "from_version": { "source_package_name": "pollinate", "source_package_version": "4.33-4ubuntu6", "version": "4.33-4ubuntu6" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "xxd", "from_version": { "source_package_name": "vim", "source_package_version": "2:9.1.2141-1ubuntu4.7", "version": "2:9.1.2141-1ubuntu4.7" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.04 resolute image from release image serial 20260723 to 20260821", "from_series": "resolute", "to_series": "resolute", "from_serial": "20260723", "to_serial": "20260821", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }