Stanislav Fort discovered that OpenSSL incorrectly handled memory when trying to decrypt CMS messages encrypted with password-based encryption. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-9230)
Stanislav Fort discovered that OpenSSL had a timing side-channel in SM2 signature computations on ARM platforms. A remote attacker could possibly use this issue to recover private data. This issue only affected Ubuntu 25.04. (CVE-2025-9231)
Stanislav Fort discovered that OpenSSL incorrectly handled memory during HTTP requests when "noproxy" environment variable is set. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.04. (CVE-2025-9232)
USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS.
In addition, this update fixes CVE-2026-42533 for these releases.
It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could possibly use this issue to crash nginx, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-42533)
Original advisory details:
It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176)
It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93479)
It was discovered that nginx incorrectly handled HTTP/3 requests when proxyrequestbuffering was enabled. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use this issue to inject data into proxied requests. (CVE-2026-95101)
It was discovered that nginx incorrectly handled asynchronous file I/O in certain configurations with Server Side Includes pages. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-97205)
It was discovered that nginx incorrectly handled SSL session ticket keys when configured with a shared session cache but without explicit ticket key rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. A remote attacker could possibly use this issue to forge client SSL sessions and bypass client certificate verification. (CVE-2026-97629)
Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package and achieve remote code execution with root privileges.
Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. (CVE-2025-27558)
It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - Cryptographic API; - GPU drivers; - InfiniBand drivers; - Media drivers; - NVIDIA Tegra memory controller driver; - Network drivers; - STMicroelectronics network drivers; - NVME drivers; - SCSI subsystem; - Thermal drivers; - USB over IP driver; - Ext4 file system; - Network file system (NFS) server daemon; - SMB network file system; - IPv4 networking; - Network traffic control; - TCP network protocol; - Tracing infrastructure; - Locking primitives; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Ceph Core library; - DCCP (Datagram Congestion Control Protocol); - IPv6 networking; - Multipath TCP; - Netfilter; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - X.25 network layer; (CVE-2021-47202, CVE-2021-47354, CVE-2021-47378, CVE-2024-38612, CVE-2024-56643, CVE-2026-23272, CVE-2026-23455, CVE-2026-31402, CVE-2026-31405, CVE-2026-31414, CVE-2026-31448, CVE-2026-31607, CVE-2026-31637, CVE-2026-31649, CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31682, CVE-2026-31685, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43198, CVE-2026-43383, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43499, CVE-2026-45988, CVE-2026-46043, CVE-2026-46119, CVE-2026-46243, CVE-2026-46266, CVE-2026-46331, CVE-2026-52924, CVE-2026-52931, CVE-2026-52955, CVE-2026-52982, CVE-2026-52986, CVE-2026-53002, CVE-2026-53006, CVE-2026-53045, CVE-2026-53088, CVE-2026-53176, CVE-2026-53225, CVE-2026-53228, CVE-2026-53359)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Jürgen Groß discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to cause a denial of service (excessive kernel memory consumption) in the network backend domain. (CVE-2021-28714)
It was discovered that the Bluetooth subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3640)
Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPTAWSSIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-86409)
Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414)
Stanislav Fort discovered that curl did not correctly handle HSTS entries when an includeSubDomains parent entry was imported before a longer-lived child entry. An attacker could possibly use this issue to cause curl to use unencrypted HTTP connections. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-87862)
Stanislav Fort discovered that curl did not properly handle HSTS max-age values that exceeded calendar time structure bounds. An attacker could possibly use this issue to cause a denial of service or data loss. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-87863)
Stanislav Fort discovered that curl did not properly handle IMAP APPEND commands when CURLOPTCRLF was enabled, allowing overflow bytes to be interpreted as pipelined commands. An authenticated attacker could possibly use this issue to inject arbitrary IMAP commands. (CVE-2026-87864)
Joshua Rogers discovered that libcurl had a use-after-free vulnerability in the FTP wildcard matching code. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-92388)
Joshua Rogers discovered that libcurl's TFTP state machine did not properly validate transfer directions, allowing a malicious server to force the client into transmit mode. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-92389)
Joshua Rogers discovered that curl had a stack overflow vulnerability when processing deeply nested MIME structures. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-92391)
Joshua Rogers discovered that libcurl could expose credentials in the URL returned by CURLINFOEFFECTIVEURL when credentials were retrieved from a .netrc file. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-94266)
It was discovered that the Bluetooth subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3640)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - File systems infrastructure; (CVE-2022-49058)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
It was discovered that libass incorrectly handled parsing operations for specific nested character strings. An attacker could use this issue to cause libass to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-24994)
It was discovered that libass incorrectly handled certain outline processing operations. An attacker could use this issue to cause libass to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-26682)
It was discovered that libass incorrectly handled certain ASS subtitle files when measuring wrapped lines. An attacker could use this issue to cause libass to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-61627)
It was discovered that libass incorrectly handled certain Matroska subtitle chunks with negative ReadOrder values. An attacker could use this issue to cause libass to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-61626)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
It was discovered that a use-after-free vulnerability existed in the Bluetooth stack in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3640)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SCSI subsystem; - Network file system (NFS) client; - NILFS2 file system; - File systems infrastructure; - Memory management; - Bluetooth subsystem; - Network traffic control; - USB sound devices; (CVE-2024-50116, CVE-2021-47576, CVE-2024-53197, CVE-2024-46787, CVE-2025-37798, CVE-2024-49958, CVE-2021-47260, CVE-2025-37932, CVE-2022-49909)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this to expose sensitive information from the host OS. (CVE-2025-40300)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - DMA engine subsystem; - GPU drivers; - HSI subsystem; - Ethernet team driver; - TTY drivers; - Ext4 file system; - Timer subsystem; - DCCP (Datagram Congestion Control Protocol); - IPv6 networking; - NET/ROM layer; - SCTP protocol; - USB sound devices; (CVE-2021-47294, CVE-2021-47330, CVE-2023-52574, CVE-2023-52650, CVE-2024-50006, CVE-2024-50299, CVE-2024-53124, CVE-2024-53150, CVE-2024-56767, CVE-2025-37838, CVE-2025-38352)
Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this to expose sensitive information from the host OS. (CVE-2025-40300)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - DMA engine subsystem; - GPU drivers; - HSI subsystem; - Ethernet team driver; - Ext4 file system; - Timer subsystem; - DCCP (Datagram Congestion Control Protocol); - IPv6 networking; - NET/ROM layer; - SCTP protocol; - USB sound devices; (CVE-2023-52574, CVE-2023-52650, CVE-2024-41006, CVE-2024-50006, CVE-2024-50299, CVE-2024-53124, CVE-2024-53150, CVE-2024-56767, CVE-2025-37838, CVE-2025-38352)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Hardware crypto device drivers; - GPU drivers; - IIO subsystem; - Media drivers; - Network drivers; - SCSI subsystem; - SPI subsystem; - USB Gadget drivers; - Ceph distributed file system; - File systems infrastructure; - JFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - NILFS2 file system; - SMB network file system; - CAN network layer; - IPv6 networking; - MAC80211 subsystem; - Netfilter; - Netlink; - Network traffic control; - SCTP protocol; - TIPC protocol; (CVE-2024-56650, CVE-2024-26915, CVE-2024-50237, CVE-2024-53140, CVE-2024-26996, CVE-2021-47506, CVE-2024-26974, CVE-2025-21971, CVE-2024-56770, CVE-2024-53063, CVE-2021-47245, CVE-2024-36934, CVE-2021-47500, CVE-2024-53173, CVE-2021-47219, CVE-2024-46771, CVE-2024-56631, CVE-2024-46780, CVE-2024-35864, CVE-2021-46959, CVE-2021-47191, CVE-2021-47587, CVE-2024-53066, CVE-2024-56642, CVE-2021-47163, CVE-2024-50256, CVE-2021-47150, CVE-2024-56598, CVE-2024-26689, CVE-2023-52741, CVE-2024-49944)
Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Hardware crypto device drivers; - GPU drivers; - IIO subsystem; - Media drivers; - Network drivers; - SCSI subsystem; - SPI subsystem; - USB Gadget drivers; - Ceph distributed file system; - File systems infrastructure; - JFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - NILFS2 file system; - SMB network file system; - CAN network layer; - IPv6 networking; - MAC80211 subsystem; - Netfilter; - Netlink; - Network traffic control; - SCTP protocol; - TIPC protocol; (CVE-2024-46771, CVE-2021-47500, CVE-2024-56631, CVE-2021-47219, CVE-2021-47163, CVE-2024-50256, CVE-2024-56650, CVE-2024-46780, CVE-2021-47506, CVE-2024-26996, CVE-2025-21971, CVE-2021-47587, CVE-2021-47245, CVE-2024-56598, CVE-2021-46959, CVE-2024-26974, CVE-2024-56642, CVE-2023-52741, CVE-2021-47150, CVE-2024-53173, CVE-2024-26915, CVE-2024-36934, CVE-2024-56770, CVE-2024-53063, CVE-2021-47191, CVE-2024-26689, CVE-2024-53066, CVE-2024-35864, CVE-2024-50237, CVE-2024-53140, CVE-2024-49944)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: