SB2026103139 - Ubuntu update for linux
Published: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 vulnerabilities.
1) Information exposure (CVE-ID: CVE-2017-5967)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to information exposure error within the __queue_delayed_work() function in kernel/workqueue.c, within the copyright() function in kernel/time/timer_stats.c, within the print_timer() function in kernel/time/timer_list.c, within the internal_add_timer(), do_init_timer(), __mod_timer(), add_timer_on(), del_timer(), try_to_del_timer_sync(), expire_timers() and init_timer_cpus() functions in kernel/time/timer.c, within the hrtimers_resume(), remove_hrtimer(), hrtimer_start_range_ns(), __hrtimer_init() and __run_hrtimer() functions in kernel/time/hrtimer.c, within the __kthread_queue_delayed_work() function in kernel/kthread.c. A local non-authenticated attacker can gain access to sensitive information.
2) Null pointer dereference (CVE-ID: CVE-2018-13093)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists in the lookup_slow() function in the Extended File System (XFS) component, as defined in the source code file fs/xfs/xfs_icache.c due to boundary error when mounting XFS filesystems. A local attacker can mount an XFS filesystem that submits malicious input, trigger NULL pointer dereference memory error and cause the affected software to terminate abnormally.
3) Divide by zero (CVE-ID: CVE-2018-13097)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists in the user_block_count() function in the Flash-Friendly File System (F2FS) component, as defined in the source code file fs/f2fs/super.c due to boundary error when mounting F2FS filesystems. A local attacker can access the system and mount an F2FS filesystem that submits malicious input, trigger divide-by-zero memory error and cause the affected software to terminate abnormally.
4) Divide-by-zero (CVE-ID: CVE-2018-13100)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to improper validation of secs_per_zone information in a corrupted Flash-Friendly File System (F2FS) image. A local attacker can mount a specially crafted F2FS image, trigger a divide-by-zero condition in the reset_curseg() function, as defined in the fs/f2fs/super.c source code file and cause the system to crash.
5) Integer overflow (CVE-ID: CVE-2018-5848)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
6) Use-after-free (CVE-ID: CVE-2021-3752)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the Linux kernel’s Bluetooth subsystem when a user calls connect to the socket and disconnect simultaneously. A local user can escalate privileges on the system.
7) Race condition (CVE-ID: CVE-2021-39634)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a race condition in the OS kernel. A local application can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
8) Use-after-free (CVE-ID: CVE-2021-4083)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the Linux kernel's garbage collection for Unix domain socket file handlers. A local user can call close() and fget() simultaneously and can potentially trigger a race condition, which in turn leads to a use-after-free error and allows privilege escalation.
9) Missing initialization of resource (CVE-ID: CVE-2022-24448)
CWE-ID: CWE-909 - Missing initialization of resource
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to missing initialization of resource within the fs/nfs/dir.c in the Linux kernel. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.
10) Improper input validation (CVE-ID: CVE-2026-53131)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in netfilter Ethernet header handling when processing packets that reach ip6t_eui64, xt_mac, ipset bitmap:ip,mac, hash:ip,mac, hash:mac, or nf_log_syslog code paths without a valid Ethernet MAC header. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue occurs because these paths access eth_hdr(skb) after insufficient validation that the skb is associated with an Ethernet device and that a full MAC header is present.
Remediation
Install update from vendor's website.