Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-25210 | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for t | expat expat expat expat |
| CVE | CVE-2026-24515 | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. | expat expat expat expat |
| CVE | CVE-2025-59375 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. | expat expat |
| Launchpad | 2137664 | Noble update: upstream stable patchset 2026-01-07 | linux |
| Launchpad | 2141314 | xhci_find_slot_id_by_port kernel panic on boot on arm64 | linux |
| Launchpad | 2140984 | GTK4 failing tests on s390x with newer mesa | gtk4 gtk4 |
| Launchpad | 2085698 | Gesture in file chooser are not added, leading an huge Memory leak | gtk4 gtk4 |
| Launchpad | 2138276 | [noble:linux-xilinx] Disable cpu governor in ubuntu-xilinx kernel | linux-xilinx |
| Launchpad | 2139694 | SEGV in remmina or xfreerdp since upgrade to 2.6.1+dfsg1-3ubuntu2.8 on jammy | freerdp2 freerdp2 freerdp2 freerdp2 |
| CVE | CVE-2026-1539 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTT | libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 |
| CVE | CVE-2026-1536 | A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) seq | libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 |
| CVE | CVE-2026-1467 | A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP pro | libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 |
| Launchpad | 2140033 | apply NVIDIA k6.8 patches Feb 3, 2026 | linux-nvidia-tegra |
| CVE | CVE-2025-22037 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send mal | linux |
| CVE | CVE-2025-39813 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calli | linux |
| CVE | CVE-2025-39825 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the re | linux |
| CVE | CVE-2025-39697 | In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_request | linux |
| CVE | CVE-2025-39828 | In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported | linux |
| CVE | CVE-2025-39832 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertio | linux |
| CVE | CVE-2025-39826 | In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_nei | linux |
About
-
Send Feedback to @ubuntu_updates
