SB2026081491 - Ubuntu update for linux-oem-7.0
Published: August 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 23 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-53186)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in srp_process_rsp() when processing a crafted SRP_RSP response from an SRP target. A remote user can send a specially crafted SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len value to cause a denial of service.
Exploitation requires that the initiator is logged into a malicious or compromised SRP target on the InfiniBand or RoCE fabric.
2) Out-of-bounds write (CVE-ID: CVE-2026-46331)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in tcf_pedit_act() when processing packet edit actions with typed keys and runtime header offsets. A local user can supply crafted pedit parameters that cause writes to a region that has not been properly copy-on-written to cause memory corruption.
The issue can involve negative offsets such as Ethernet header edits at ingress.
3) Use-after-free (CVE-ID: CVE-2026-52924)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the SCTP outqueue and stream scheduler state handling when processing a stale COOKIE-ECHO condition. A remote attacker can send a stale cookie error during SCTP association handling to cause a denial of service.
The issue occurs when an association is rolled back from COOKIE_ECHOED to COOKIE_WAIT, leaving scheduler state referencing freed stream entries.
4) Improper input validation (CVE-ID: CVE-2026-53131)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in netfilter Ethernet header handling when processing packets that reach ip6t_eui64, xt_mac, ipset bitmap:ip,mac, hash:ip,mac, hash:mac, or nf_log_syslog code paths without a valid Ethernet MAC header. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue occurs because these paths access eth_hdr(skb) after insufficient validation that the skb is associated with an Ethernet device and that a full MAC header is present.
5) Out-of-bounds read (CVE-ID: CVE-2026-53146)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in tb_xdomain_copy() in the thunderbolt xdomain component when processing a short response frame. A local user can send a specially crafted short response to disclose sensitive information.
6) Out-of-bounds read (CVE-ID: CVE-2026-53147)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in tb_xdp_handle_request() in the thunderbolt xdomain request handler when processing a crafted XDomain request packet that is shorter than the expected protocol-specific structure. A remote attacker can send a minimal crafted XDomain packet to disclose sensitive information.
A generic header length check can be passed even when the packet is too short for the protocol-specific structure accessed after the type cast.
7) Out-of-bounds write (CVE-ID: CVE-2026-53148)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in tb_xdp_properties_request() in the thunderbolt xdomain handler when processing a crafted XDomain response from a malicious peer. A remote attacker can send a response with a forged length field to cause memory corruption.
8) Out-of-bounds read (CVE-ID: CVE-2026-53149)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in __tb_property_parse_dir() in the thunderbolt property parser when parsing a crafted root directory property block. A local user can supply a crafted property block to cause a denial of service.
9) Out-of-bounds write (CVE-ID: CVE-2026-53150)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in tb_property_entry_valid() and the TEXT property null-termination logic in drivers/thunderbolt/property.c when parsing XDomain property entries. A local attacker can provide a crafted zero-length TEXT property entry to cause a denial of service.
10) Out-of-bounds read (CVE-ID: CVE-2026-53151)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in rxrpc_input_soft_acks() when parsing the SACK table from a fragmented UDP packet. A remote attacker can send a deliberately fragmented packet to cause a denial of service.
The issue affects AF_RXRPC extended ACK parsing, and exploitation likely requires a deliberately pre-generated fragmented packet.
11) Use-after-free (CVE-ID: CVE-2026-53175)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in inet_frag_queue_flush() and fragment reassembly handling when processing fragmented network packets during network namespace teardown. A remote attacker can send fragmented packets and trigger reuse of a flushed fragment queue to cause a denial of service.
IPv6, nf_conntrack_reasm6, and 6lowpan reassembly share the same affected flush path.
12) Out-of-bounds write (CVE-ID: CVE-2026-53176)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in isert_login_recv_done() and isert_rx_login_req() in drivers/infiniband/ulp/isert/ib_isert.c when processing a login PDU shorter than ISER_HEADERS_LEN. A remote attacker can send a specially crafted login send work request to cause a denial of service.
The vulnerable code path is reachable during the login phase before iSCSI authentication.
13) Use-after-free (CVE-ID: CVE-2026-53359)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the KVM x86 shadow paging logic when changing a PDE mapping from outside the guest and deleting a memslot. A local user can trigger stale rmap entries and subsequent dereference of a freed sptep to cause a denial of service.
The issue occurs when a modified PDE points to a non-leaf page, causing a role mismatch between reused shadow pages for large 2MB mappings and new 4KB mappings.
14) Use-after-free (CVE-ID: CVE-2026-53212)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in nft_tunnel_obj_destroy() in net/netfilter/nft_tunnel.c when processing packets that still hold a reference to metadata_dst after object destruction. A local user can trigger packet queuing and object destruction to cause a denial of service.
Exploitation requires packets to remain queued, such as in a netem qdisc, until they are later dequeued.
15) Use-after-free (CVE-ID: CVE-2026-53215)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in the mvpp2 RX buffer handling in drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c when processing received packets through XDP or skb paths. A local attacker can trigger packet processing that returns a retired buffer to the BM pool to cause a denial of service.
Hardware may DMA into memory that is no longer owned by the RX ring after the buffer has been recycled, redirected, queued for XDP_TX, or freed.
16) Out-of-bounds write (CVE-ID: CVE-2026-53216)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt memory or cause a denial of service.
The vulnerability exists due to an out-of-bounds write in the mvpp2 XDP receive path when processing packets with XDP tail adjustment on short RX buffers. A local user can trigger bpf_xdp_adjust_tail() on a packet to corrupt memory or cause a denial of service.
The issue occurs because the XDP frame size is initialized larger than the actual backing buffer size for short BM pool buffers.
17) Improper input validation (CVE-ID: CVE-2026-53221)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause traffic to be associated with the wrong tunnel.
The vulnerability exists due to improper input validation in vti6_tnl_lookup() when matching IPv6 VTI tunnels during fallback wildcard tunnel searches. A remote attacker can send network traffic that triggers a hash collision and incorrect tunnel selection to cause traffic to be associated with the wrong tunnel.
The issue occurs because candidate tunnels in the fallback search were not verified to actually use wildcard local or remote addresses.
18) Out-of-bounds read (CVE-ID: CVE-2026-53224)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in SCTP cookie processing in sctp_unpack_cookie(), sctp_process_init(), and sctp_raw_to_bind_addrs() when handling a malformed COOKIE_ECHO containing a truncated embedded INIT chunk or malformed address parameters. A remote attacker can send a specially crafted COOKIE_ECHO to cause a denial of service.
When cookie authentication is disabled, an oversized raw address list length can also be used to trigger the out-of-bounds read condition.
19) Out-of-bounds read (CVE-ID: CVE-2026-53225)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in __sctp_rcv_asconf_lookup() in net/sctp/input.c when processing a truncated trailing ASCONF chunk containing a declared IPv6 address parameter. A remote attacker can send a specially crafted SCTP packet to disclose sensitive information.
The issue is reachable from the no-association lookup path.
20) Use-after-free (CVE-ID: CVE-2026-53228)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to a use-after-free in the ipip6_tunnel_xmit() function in the SIT IPv6 tunneling implementation when handling GSO packets after offload processing. A local user can trigger transmission of a crafted packet to disclose sensitive information.
The issue occurs because a cached inner IPv6 header pointer may become stale if the skb head is moved during offload handling, and the stale pointer may later be used to read header fields.
21) Out-of-bounds read (CVE-ID: CVE-2026-53246)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or cause memory corruption.
The vulnerability exists due to an out-of-bounds read in sctp_unpack_cookie() and cached peer INIT chunk processing when processing a crafted COOKIE_ECHO chunk. A remote attacker can send a specially crafted COOKIE_ECHO chunk with an inflated cached INIT chunk length to disclose sensitive information or cause memory corruption.
The issue occurs in a listening SCTP server while walking parameters from the cached peer INIT chunk embedded after the cookie.
22) Use-after-free (CVE-ID: CVE-2026-53247)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the mtk_eth_soc driver metadata dst teardown path when tearing down the device while packets still hold a non-refcounted pointer to metadata_dst. A local user can trigger the teardown condition to cause a denial of service.
The issue arises in the RX path because skb_dst_set_noref() requires RCU read-side protection and the destination object must remain valid until all RCU readers have completed.
23) Use-after-free (CVE-ID: CVE-2026-53260)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free race condition in reqsk_queue_hash_req() in net/ipv4/inet_connection_sock.c when handling TCP request socket timer setup and reference count initialization on PREEMPT_RT systems. A local user can trigger the race to cause a denial of service.
Exploitation requires a PREEMPT_RT-enabled kernel.
Remediation
Install update from vendor's website.